How to secure session cookies I am facing a session cookie hijacking vulnerability please refer the attached 


  image. When i put these cookie in another browser which i simply type
  the domain like http://example.com and add the copy cookie using the
  extension then simply i change the url to example.com/dashboard
  then user dashboard automatically open just because of copy cookie
  all have the same label only value is different.
The value of the cookie needs to be kept a secret, otherwise as you point out, someone can 'hijack' the session and perform actions as the original user.

Under normal circumstances an attacker wouldn't be able to get the value of this cookie from your browser, if they can, then they're into your machine, and can probably do what they like. Game over.

That leaves man-in-the-middle attacks as a way to get the value of this cookie, and you avoid those by running the site over HTTPS, so that the value of the cookies is encrypted in transit, and only readable by the client and the server.