PRACTICAL NO:15
                          SESSION HIJACKING
CODE:
from flask import Flask, request, make_response, redirect
app = Flask(__name__)
USERS = {
    "student": "1234"
}
@app.route("/")
def home():
    session_id = request.cookies.get("session")
    if session_id == "student-session":
        return """
        <h2>Welcome Student!</h2>
        <p>You are logged in.</p>
        """
    return """
    <h2>Demo Login</h2>
    <form method="POST" action="/login">
        Username: <input name="username"><br><br>
        Password: <input name="password" type="password"><br><br>
        <button type="submit">Login</button>
    </form>
    """
@app.route("/login", methods=["POST"])
def login():
    username = request.form["username"]
    password = request.form["password"]
    if USERS.get(username) == password:
        response = make_response(redirect("/"))
        response.set_cookie("session", "student-session")
        return response
    return "Invalid credentials"
app.run(host="127.0.0.1", port=5000)
OUTPUT:
