CI Session and Firesheap

[eluser]WanWizard[/eluser]
Firesheep uses a technique called "sidejacking" which involves intercepting the session cookie.

If used properly, CI's session cookies are save from this technique, since they contain information that links the session to a specific PC and browser (using an IP and browser agent check).
Furthermore, a CI session cookie should be encrypted, which makes it useless for any interceptor, and should also contain absolutely NO user data (so don't use cookie only sessions, use the database or another server based storage system).

Another safe measure is to allow access to your site only via HTTPS. This encrypts the communication between browser and site, so nothing can be intercepted. Encryption is CPU intensive, so think about server sizing (or possible offloading) if you want to go this route.