How do I protect my site's session cookie?

Question

Session cookies are quickly becoming a standard way of doing login management. However, if sent unencrypted, it's pretty easy to hijack someone's session ala Firesheep.

Now, you can solve this by making your entire site use HTTPS, but if someone types in mysite.com the browser defaults to http. We can solve this with a redirect:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

But by the time I get a chance to rewrite the URL, hasn't my session cookie already been sent over an insecure channel?

Answer 1

Mark your session cookie as HTTPS-only using the Secure option.