# Session Hijacking Protection

DevFeed: [Session Hijacking Protection](<https://devfeed.tech/articles/session-hijacking-protection-1257.md>)

Original publisher: [Read original article](<https://shopify.engineering/17488076-session-hijacking-protection>)

Author: Shopify Engineering

Published: 2010-11-23T18:56:00Z

Content type: article

Language: en

Sources: [Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering.md>), [Shopify Engineering - Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering-shopify-engineering.md>)

Topics: [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [backend](<https://devfeed.tech/tags/backend.md>), [browser](<https://devfeed.tech/tags/browser.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [firefox](<https://devfeed.tech/tags/firefox.md>), [frontend](<https://devfeed.tech/tags/frontend.md>), [http](<https://devfeed.tech/tags/http.md>), [servers](<https://devfeed.tech/tags/servers.md>), [shopify](<https://devfeed.tech/tags/shopify.md>), [ssl](<https://devfeed.tech/tags/ssl.md>)

## AI overview

Shopify describes protecting its admin area from HTTP session-cookie hijacking by enforcing SSL and securing cookies. It also explains why applying SSL across merchant storefronts is more difficult because they use many custom domains.

## Source excerpt

There's been a lot of talk in the past few weeks about "Firesheep", a new program that lets users hijack other users' accounts on many different websites. But there's no need to worry about your Shopify account -- we've taken steps to ensure your account can't be hijacked and your data is safe.