A mail session is the authenticated browser state that keeps a user logged into webmail. It is usually maintained with cookies, tokens, or other session data, so the mailbox stays accessible without re-entering credentials on every request. In practice, the session is the trust wrapper around inbox actions such as reading messages, sending mail, changing rules, or managing contacts.
Mail sessions matter because attackers often target the session instead of the password. If an attacker steals, reuses, or abuses session state, they can act as the victim inside the mail interface, sometimes without triggering a fresh login prompt. Cross-site scripting, phishing pages, token theft, and proxy-based interception are common ways to attack it. Defenders protect mail sessions with short lifetimes, secure cookie settings, MFA, device and IP checks, and monitoring for unusual mailbox activity or rule changes.