Firesheep is nothing new. Session hijacking has been around for as long as web applications have been using Session IDs. Usually hackers just set their own cookie by typing this into the address bar: javascript:document.cookie="SOME_COOKIE". This tool is for script kiddies that fear 1 line of JavaScript.
Cookies can be hijacked if you don’t use HTTPS for the entire life of the session and this is a part of OWASP A9 – Insufficient Transport Layer Protection. But you can also hijack a session with XSS.
1) Use httponly cookies.
2) Use “secure cookies” (Horrible name, but it’s a flag that forces the browser to make the cookie HTTPS only.)
3) Scan your web application for XSS.
Also don’t forget about CSRF! (Which Firesheep doesn’t address.)