Index: securepages_prevent_hijack.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/securepages_prevent_hijack/securepages_prevent_hijack.module,v
retrieving revision 1.1.2.10
diff -u -p -r1.1.2.10 securepages_prevent_hijack.module
--- securepages_prevent_hijack.module	6 May 2010 18:13:03 -0000	1.1.2.10
+++ securepages_prevent_hijack.module	23 Dec 2010 16:03:17 -0000
@@ -34,6 +34,20 @@ function securepages_prevent_hijack_init
       exit();
     }
   }
+  
+  // If the cookie exists on an unsecured page then there's a chance for the
+  // session to be stolen.  Destroy the session.
+  elseif (!securepages_is_secure() && isset($_COOKIE[SECUREPAGES_SESSID])) {
+    watchdog('security',
+    t('Session hijack attempt detected for user %user!',
+    array('%user' => $user->name)));
+
+    session_destroy();
+    $user = drupal_anonymous_user();
+    sess_regenerate();
+    drupal_access_denied();
+    exit();
+  }
 }
 
 /**