This will help reduce session hijacking vulnerabilities since the session id cannot be sniffed and easily hijacked 这样会话id不会被探嗅到而且不容易被截获,就可以减少会话截获的危险。
To exploit this vulnerability seems even easier than session hijacking , as the attacker stays in the middle acting as an ap access point to the real user , and as a user to the actual ap 利用这一弱点甚至好象比会话劫持更容易,因为攻击者处于实际用户和实际ap (接入点)之间,它对于实际用户冒充ap ,对于实际ap则冒充用户。
In computer science, session hijacking is the exploitation of a valid computer session?sometimes also called a session key?to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server.