Which mitigation strategy should be used to protect against session hijacking attacks in a cloud...

Session hijacking succeeds when an attacker obtains or abuses a valid session identifier, commonly one stored in a browser cookie. Secure cookie controls directly protect that credential. The Secure attribute limits transmission to HTTPS, reducing exposure over cleartext connections; HttpOnly prevents client-side scripts from reading the cookie; and an appropriate SameSite setting limits cross-site sending. Strong session handling should also use unpredictable identifiers, rotation after authentication, expiration, and server-side revocation. Input validation primarily mitigates injection vulnerabilities. Least privilege can reduce the damage after compromise but does not stop theft of a session token. Anti-CSRF tokens prevent unauthorized cross-site requests made through a victim’s authenticated browser, but they are not the primary protection against capture of the session cookie itself. Therefore, secure cookies are the best answer. RFC 6265 HTTP cookie specification