Authentication & Session Security

Logging in proves who someone is once; a session is how the site remembers that for every request afterward, usually via a cookie containing a session ID. If that cookie leaks, an attacker doesn't need a password at all — they can just reuse the session ID and the site will treat them as the real user.

A few practices that keep sessions from leaking: marking session cookies HttpOnly (so JavaScript, including an XSS payload, can't read them), Secure (so they're only ever sent over HTTPS, never in the clear), issuing a brand new session ID after login rather than reusing a pre-login one, and expiring sessions after a period of inactivity so a stolen cookie doesn't stay valid forever.