Sessions are signed and httpOnly; sensitive actions re-verify that it's you. Accounts with two-factor authentication enter their authenticator code at sign-in.
New here? Create an account