security - Why can't the Yesod session cookie be hijacked? -

the yesod book says

the encryption prevents user inspecting data, , signature ensures session can neither hijacked nor tampered with.

it's not clear me why case. if eavesdropper gets hold of cookie sent server , uses before legitimate user makes request, won't session end being hijacked?

it seems me way prevent session hijacking use ssl throughout. if signing , encryption done yesod ends being unnecessary overhead (edit: overhead far preventing hijacking concerned. @sr_ points out in comments, still useful otherwise).

that's catch. used more accurate, when include ip address of client in cookie prevent hijacking. combined anti-tampering protections, made impossible mitm attack work unless nated behind same router or using same proxy.

unfortunately, had disable protection due concerns proxies well. it's possible single user's requests come multiple ip addresses due intermediate proxy servers. don't have data tell how happens, there enough concern security feature causing breakage disabled it.

thank bringing up, i've corrected book.