News for hackers. Stuff that matters.

A comment on Ask HN: Best Approaches to Prevent Session Hijacking?.

Re:Ask HN: Best Approaches to Prevent Session Hijacking? by adyus on Thursday June 16, 2011 @10:28PM (#2664092)
How about checking the logged user's IP address on each page refresh and storing it on the server, and if there's more than one IP for the same user, invalidate the session?
[ Parent | on HN ]
Re:Ask HN: Best Approaches to Prevent Session Hijacking? by espeed on Friday June 17, 2011 @02:02AM (#2664511)
Yes, that's a good tactic and worth doing, but IP addresses can be spoofed.
[ Parent | on HN ]