title: Is HTTPS the only defense against Session Hijacking in an open network?
body: <p>So with <a href="http://codebutler.com/firesheep" rel="noreferrer">Firesheep</a>, everyone in a public Wi-Fi now has a one-click session hijack tool.</p>
  
  <p>The way it works - to my understanding - is that it simply captures all traffic and grabs the session cookie (so it doesn't steal passwords).</p>
  
  <p>From my understanding, this also means that a HTTPS secured login does not solve this alone, as further HTTP traffic would include the Session Cookie in clear text again.</p>
  
  <p>Tying the session to a specific IP address is useless thanks to NAT, and tying it to the user agent is easy to spoof.</p>
  
  <p>So is 100% HTTPS at all times the only way to prevent this type of session hijacking? Couldn't people simply sniff the entire HTTPS Traffic including the handshake, or is this stuff safe? (I'm thinking of replay attacks, but have no knowledge in that area.)</p>
  
  <p>Of course, not using public/open Wi-Fi Networks is the better choice, but I'm still interested what a website developer can do to protect his/her users.</p>