How HTTP Works: Requests, Cookies & Session Hijacking (Animated)

HTTP is the language of the web: the browser sends a request, the server sends a response. HTTP itself remembers nothing between requests, so websites use cookies to know you are logged in. Steal the cookie and you steal the session.

1. Request & response: ask for a page, get a page

After the TCP handshake, the browser sends a text request. The first line holds the method, the path and the version; headers follow.

1. GET (Your laptop → Web server): GET is the method, /index.html the path. The Host header says which website on that server is wanted.
2. 200 OK (Web server → Your laptop): 200 means success. Others you’ll meet daily: 301 moved, 403 forbidden, 404 not found, 500 server error.

Wireshark filter:

http.request

2. Login & cookie: how the site remembers you

The browser POSTs the login form. If the password is right, the server creates a session and sends its ID back in a Set-Cookie header.

1. POST (Your laptop → Web server): On plain HTTP the form body, including the password, crosses the network as readable text.
2. 302 FOUND (Web server → Your laptop): The server issues session=8f3a1c9e7b. That random value now is your identity on this site.
3. GET (Your laptop → Web server): Every later request carries the cookie automatically, so the server knows it’s Priya without asking for the password again.

Wireshark filter:

http.request.method == "POST"

3. Session hijacking: attack: steal the cookie, become the user

On an open or shared Wi-Fi, an attacker can read unencrypted traffic. They don’t need the password: copying the session cookie is enough.

1. GET (Your laptop → Web server): Priya browses normally over HTTP.
2. SNIFFED (Router → Attacker): The attacker’s sniffer sees the same packet and extracts the cookie.
3. GET (Attacker → Web server): The attacker sends a request with Priya’s cookie from their own machine.
4. 200 OK (Web server → Attacker): The server cannot tell the difference. The attacker is inside the account without ever knowing the password.

Wireshark filter:

http.cookie contains "session"

4. Https & safe cookies: defence: encrypt it and lock the cookie

HTTPS encrypts the whole exchange, and cookie flags stop the browser from ever sending the cookie insecurely.

1. HTTPS (Your laptop → Web server): The same request, now inside TLS.
2. SNIFFED (Router → Attacker): The sniffer still captures the packet, but it is unreadable. No cookie, no password.

Server response header:

Set-Cookie: session=…; Secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=31536000

FAQ