The information in session state is very secure, because it is stored exclusively on the server. However,the cookie with the session ID can easily become compromised. This means an eavesdropper could steal the cookie and assume the session on another computer. Several workarounds address this problem. One common approach is to use a custom session module that checks for changes in the client’s IP address.
