title: How to protect session id and cookies without using SSL/HTTPS?
body: <p>As for as I understand, if I do not use SSL/HTTPS, cookies and session ids travel as plain text over the wire. An attacher can use packet sniffer to get his hand on these. How can I protect this without using SSL/HTTPS? I am guessing that the solution would consists of doing something both on client side and server side to take care of this. My server side is Java.</p>