There are a few things that can be done. 1. Use session tokens. 2. Use cookie security flags (httponly and secure). 3. Shorten the expiry time. 4. Properly encrypt/hash the data.