Session Hijacking Protection - Shopify

What this post added

This post details the implementation of session hijacking protection at Shopify in response to the Firesheep vulnerability. It explains the technical details of HTTP session cookie hijacking and the limitations of relying solely on SSL for all traffic, particularly with custom merchant domains. The core technical contribution is the development of a custom `MultiSessionStore` for Ruby on Rails. This solution allows Shopify to enforce the use of secure cookies for backend administrative traffic (under *.myshopify.com) while still allowing for less secure cookies on the frontend, thereby mitigating the risk of session hijacking without requiring individual SSL certificates for every merchant's custom domain.