Re: How can i protect against session hijacking?

[Adam Todorski <todora () rpi edu>]

> > Try installing a Web Application Firewall (WAF) 
> > that prevents attacks like this, there are several 
> > on the market...
>
> LOL; this I want to hear.  Explain how a WAF addresses: 

Indeed, what does a "WAF" get you that competent programming and systems 
administration practices don't?  (No really, I want to know).  I guess I 
can see a niche case where you have to secure an webapp for which you do 
not have the source and in which there are known programming 
deficiencies, but then if it's that important why did you choose a 
deficient product in the first place?

Don't forget your firewall rules for the web servers themselves (if the 
web server doesn't need to talk to the Internet or other hosts other 
than to respond to HTTP(S) requests then don't let it, etc).

-Adam