Vulnerable Cookies
I’ve Found a Great PDF about XSS Attack , and how the Middle Layer man can hijack your session and cookies. and also how to encounter it
https://www.isecpartners.com/files/web-session-management.pdf
You should always set your Domain, HttpOnly Attribute(not writeable from js) on your Cookies and use the HTTPS so the middle layer man can’t see it in plain text.