如果有人嗅探您加密的cookie数据并将其原样发送到服务器怎么办？

Question

This might be an irrelevant question , but I'm wondering whether this can happen..

In HTTPS cookie data like phpssid transfers as an encrypted big random number.

What if someone sniffs that encrypted random number and send it to the server as it is? So the server decrypt that id and allows the hacker to log in as someone else. Is this possible?

Answer 1

Yes, exactly. Cookie data if discovered by a third party may be replayed to replicate functionality. Note that you say someone 'sniffs' the cookie over HTTPS, which, if everything is working as it should, would not happen. If you are asking if the encrypted values of SSL/TLS can be replayed to the same effect, no that cannot happen. The plaintext value is needed for this to work.