01.04 · Concept
Sessions, Cookies & Stolen Tokens
Trace what a browser sends on the request AFTER login, and explain why a stolen session cookie defeats MFA and passkeys alike.
A session cookie is the credential your browser presents after login, so theft of that value can let another client act as you. MFA and passkeys protect the login step, but many applications authorise later requests by accepting the session token alone.
What this lesson answers
- what does browser send after login
- why do stolen cookies bypass MFA
- how do session cookies keep login alive
Notes
When you log in, the server usually gives the browser a small credential to present on later requests. Often this is a session cookie: a name-value pair stored by the browser and automatically sent back to the matching site. After login, the server does not re-check your password, MFA code, or passkey on every click. It mostly checks whether the request includes a valid session token that maps to an authenticated account.
The useful mental model is a coat-check ticket. Passwords, passkeys, and MFA prove you are allowed to receive the ticket. The session cookie is the ticket you use afterward.
References
Common questions
- Why does a stolen session cookie bypass MFA?
- MFA is usually checked during login, before the server issues a session. Later requests often prove identity by carrying the session cookie. If an attacker obtains that cookie while it is still valid, the server may accept their request as already authenticated without asking for the password, passkey, or MFA challenge again.
- Is a cookie just browser storage?
- For authentication, the critical fact is not that the value sits in browser storage. The important part is that the browser attaches it to matching requests, and the server treats it as evidence of an active session. The cookie becomes a bearer credential for the account.
- What should I inspect after logging in?
- Open developer tools, make an authenticated request, and inspect the request headers. Look for the Cookie header or another header carrying a token. That value is what keeps the session alive after the original login ceremony has finished.
Short definition: what is Sessions, Cookies & Stolen Tokens?