Broken Authentication Via Cookie Manipulation
Why is it problematic if a web application allows users to modify their session cookies directly?
What is a key security feature to protect session cookies from being accessed by malicious scripts?
After modifying a session cookie to impersonate an admin, what should a secure web application do to prevent unauthorized actions?