An apparatus comprising: logic encoded in one or more tangible media for execution and when executed operable to: establish a first transport connection between a client and a gateway server, wherein the first transport connection is authenticated by the gateway server, the gateway server generating a first authentication cookie, wherein the first authentication cookie is associated with a client session, between the client and the gateway server, that includes the first transport connection, and the gateway server sending the first authentication cookie to the client; establish a second transport connection at the gateway server; receive a request at the gateway server over the second transport connection, wherein the request includes the first authentication cookie to associate the second transport connection with the client session; generate a second authentication cookie for the client session; in response to the request, return the second authentication cookie over the second transport connection; after returning the second authentication cookie over the second transport connection, determine whether the second authentication cookie is received over the first transport connection; and detect an attack when the second authentication cookie is not received over the first transport connection. logic encoded in one or more tangible media for execution and when executed operable to: establish a first transport connection between a client and a gateway server, wherein the first transport connection is authenticated by the gateway server, the gateway server generating a first authentication cookie, wherein the first authentication cookie is associated with a client session, between the client and the gateway server, that includes the first transport connection, and the gateway server sending the first authentication cookie to the client; establish a second transport connection at the gateway server; receive a request at the gateway server over the second transport connection, wherein the request includes the first authentication cookie to associate the second transport connection with the client session; generate a second authentication cookie for the client session; in response to the request, return the second authentication cookie over the second transport connection; after returning the second authentication cookie over the second transport connection, determine whether the second authentication cookie is received over the first transport connection; and detect an attack when the second authentication cookie is not received over the first transport connection. establish a first transport connection between a client and a gateway server, wherein the first transport connection is authenticated by the gateway server, the gateway server generating a first authentication cookie, wherein the first authentication cookie is associated with a client session, between the client and the gateway server, that includes the first transport connection, and the gateway server sending the first authentication cookie to the client; establish a second transport connection at the gateway server; receive a request at the gateway server over the second transport connection, wherein the request includes the first authentication cookie to associate the second transport connection with the client session; generate a second authentication cookie for the client session; in response to the request, return the second authentication cookie over the second transport connection; after returning the second authentication cookie over the second transport connection, determine whether the second authentication cookie is received over the first transport connection; and detect an attack when the second authentication cookie is not received over the first transport connection.