A proposed system for preventing session hijacking with modified one-time cookies

Most of TCP connections use HTTP to communicate; so, it becomes mandatory for every server to create a unique identifier for each and every connection. A session is a unique identifier generated by a server that is sent to a client for identifying current interaction session, which is stored in a cookie. A cookie is a short text file for identifying a particular client. Since cookies are transmitted over HTTP, they are visible and prone to attacks such as session hijacking. HTTPS is the most widely used mechanism to protect cookies, but utilizing full HTTPS support is not that easy, especially for applications that are highly distributed due to performance and financial issues. Hence, one-time cookies (OTC) are suggested as an alternative for authentication. OTC prevents various attacks, like for example session hijacking, as they are temporarily stored for a particular period of time or only for a particular session. In this work, we propose a mechanism that uses OTC to prevent an attacker to gain access to a cookie and backend server. A reverse proxy server with OTC, IP, session ID, and browser fingerprinting are used to prevent adversary from capturing session credentials.