Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server.

Why aren't sessions always exclusive to the IP they were started on?  i.e., when would a website/service need to persist an authenticated session across multiple IP addresses? I'm not sure why sessions permit this, thus I don't understand how this is ever a feasible route for an attacker.

First, linking a session to an IP address will not make it secure since the server could see many different users as using the same IP address for various reasons (all types of proxy servers, for instance: client, reverse proxy, CDN, etc.).

Second, the same user could very well use different IP addresses for the same session. For instance, someone could be switching between networks from the same device.

So, since it's not effective and it causes usability and scalability issues, that is not an feature that is usually enabled.
