> For the complete documentation index, see [llms.txt](https://community-test.logicnets.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://community-test.logicnets.com/release-9/platform-documentation/system-administration/security/preventing-session-hijacking.md). # Preventing Session Hijacking ## Description Session hijacking is the exploitation of a valid computer session -- sometimes also called a session key -- to gain unauthorized access to information or services in a computer system. LogicNets uses secure cookies to avoid a URL with a session id being copied across browsers and clients. This prevents the hijacking of a session. ## Prevention Session hijacking prevention is enabled by default when your application uses HTTPS, but the browser must support session cookies for this to work. If the browser does not support session cookies, they are disabled, or the URL is opened on another browser, LogicNets displays the following message: ``` "You do not have access to this session." ``` The LogicNets runtime shares the session cookie between all sessions of the same browser on a client's machine. The system renews this session cookie at every login and each time a new session is created. ## Disabling Session Hijacking Prevention While we do not recommend it, you can disable session hijacking prevention in the configuration file on the server. You must edit or create a new configuration file located at */dat/bnt//settings.cfg* and you must add the following lines to the configuration file: ``` _global = _global or {} _global.SECURITY = _global.SECURITY or {} _global.SECURITY.DISABLE_SESSION_PINNING = 1 ``` ## Safari Browser and iFrames By default, the Safari browser blocks the setting of session cookies when a user opens a web page in an iFrame. You can disable this by changing the settings in you Safari browser. Go to *Privacy and Security* > *"do not track"* or by disabling session hijacking prevention. NOTE: In IE/EDGE, cookies for domains that contain one or more \_ (underscore symbol) will not be stored, making it impossible to use HTTPS. The underscore symbol is formally an illegal character for a domain name. Because of this, the use of underscores is discouraged. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://community-test.logicnets.com/release-9/platform-documentation/system-administration/security/preventing-session-hijacking.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.