If you are using session variables for your web application's security, remember to clear out all session variables (or just call Session.Abandon) immediately before processing a login attempt.
This will help prevent the sort of session hijack attempt mentioned on the following page:
This will help prevent the sort of session hijack attempt mentioned on the following page: