RE: How can i protect against session hijacking?

["Martin O'Neal" <martin.oneal () corsaire com>]

> Remote IP spoofing at the network layer is more difficult...

Actually the IP restriction argument is a bit of a red halibut; if the
app has XSS, then the attacker can simply use the mobile code to run
their follow up attack from the victims own workstation.  The same goes
for the other recommendations on the list around using SSL with client
certificates etc; they don't fix the problem, which is the data
validation and encoding omissions that allowed the XSS.  

Once you have an XSS that loses you the session ID you are already
screwed; anything else is just tinkering at the edges.

Martin...