RE: How can i protect against session hijacking?

["Martin O'Neal" <martin.oneal () corsaire com>]

> Try installing a Web Application Firewall (WAF) 
> that prevents attacks like this, there are several 
> on the market...

LOL; this I want to hear.  Explain how a WAF addresses: 

"If an attacker gets hold of the end users cookies (through XSS and so
forth), how can you actually prevent session hijacking?"

Oh, and just to be specific, in this scenario the relevant bit is the
session hijacking; the cookies and session ID are already lost via some
mechanism (which isn't of interest).

Martin...