News for hackers. Stuff that matters.

A comment on Don't use JSON web tokens for sessions. Parent comment

Re:Don't use JSON web tokens for sessions by rahkiin on Monday June 13, 2016 @05:53PM (#11898032)
Using IP addresses for session (in)validation is pretty useless now that everybody has a mobile device that moves between networks (WiFi at home, WiFi at work, 3G/4G). If you use the website while walking from WiFi to 4G you would lose session.
[ Parent | on HN ]
Re:Don't use JSON web tokens for sessions by NathanKP on Monday June 13, 2016 @07:16PM (#11898547)
This is for the use case of: "Something weird happened on my account, so I check sessions and see that someone used my account from across the country. So I log out other sessions."
[ Parent | on HN ]