Glossary
Session Handoff
Session handoff transfers an authenticated session from one device to another — scanning a code to continue on a phone what was started on a desktop, for instance — so a user doesn't have to log in again on the second device. This is a genuine convenience, and the mechanism that makes the handoff possible, whatever form it takes, is itself a value an attacker could potentially intercept or reuse to hijack the session being transferred.
A handoff mechanism designed carefully treats the transfer artifact the same way any other authentication credential deserves to be treated: valid briefly, usable once, and tied closely enough to the specific transfer in progress that a captured copy can't simply be replayed later to gain access, on a different device, to a session it was never meant to reach.