Your MFA guards the door. Your session cookie opens it.

Security is not a one-time thing. It's continuous. 🕰️

You can't expect to be secure when you're scattering your authenticated session cookies across all your integration partners. MFA is only good for obtaining the key to the door. HTTP is stateless, so whoever holds a valid key can walk through that door.

Session hijacking is one of the fastest-growing attack vectors, with a 127% year-over-year increase, as attackers target post-authentication cookies and tokens to bypass MFA entirely.

The fix

It's quite simple, actually. Bind your session cookie strictly to an exact domain or subdomain, and prevent it from being shared with other subdomains or the parent domain. The Secure flag and HTTPS-only configuration are a given.

The current reality

It's pretty bad.

Want to test it yourself? Pick the five services you use most, including your bank. Most businesses run a public static website on the apex domain and several services on subdomains. You sign in with a service on one subdomain and get redirected to the main dashboard. The authenticated session cookie is often readable by all of those subdomains and sent with every request. That's how these services identify and validate you.

You might think that's fine as long as the subdomains are internal services. Wait until marketing and monitoring enter the picture.

How the cookie leaks

Marketing wants to collect user actions and behavior, so someone asks IT to set up a subdomain that routes analytics traffic to a vendor. The IT person creating the DNS entry usually isn't responsible for the bigger picture. Now a third-party marketing provider receives your users' session cookies for free, along with the analytics traffic.

The person adding a DNS record is rarely the person thinking about where your session cookies will go.

You can keep wondering:

• What might they be doing with those cookies?
• What if they aren't protecting the data properly?
• What if one of them gets breached?

Or you can act on your end: separate your traffic and your cookies securely. Every company starts from a different place, so the fix usually takes a creative approach that reduces risk without disrupting what already works.

Why I'm writing this now

I've known these things for a while. Recently I've been in a better position to call them out openly and help our clients fix them. If you'd like to discuss or review your identity and security posture, reach out. My email and LinkedIn are on the About page.