How do I prevent session hijacking by simply copy a cookie from machine to another?

Most Web Applications use cookies to manage the session for a user and allow you to stay logged in even if the browser was closed.

Let's assume we did everything by the book to make sure the cookie itself is safe.

• encrypt the content
• set http only
• set secure
• ssl is used for the connection
• we check for tampering with the content of the cookie

Is it possible to prevent someone with physical access to the machine to copy the cookie and reuse it on another machine and thus stealing the session?

This risk is inherent in using cookies to authenticate sessions: the cookie is a bearer token, anyone who can present the cookie is authenticated.

This is why you see further protections such as:

• automatic log out after a certain amount of time, or period of inactivity;
• device fingerprinting;
• requiring re-authentication for critical actions (e.g. making a bank transfer or changing your password).