candidate: As HTTP 1.0 has been designated as a fallback for HTTP 1.1 since the early 2000s — and as HTTP 1.0 servers are all essentially HTTP 1.1 servers the session hijacking problem has evolved into a nearly permanent security risk .