Re:Show HN: Device-Bound Session Tokens in JavaScript
by gflacount on Tuesday April 16, 2024 @02:16PM
(#40055364)
How do you handle scenarios where the user’s device environment changes significantly? For example, if they clear their IndexedDB or switch devices? Does session-lock manage to maintain security in these cases?
[ Parent
| on HN ]
Re:Show HN: Device-Bound Session Tokens in JavaScript
by thekeyper on Tuesday April 16, 2024 @02:28PM
(#40055505)
If the browser loses the private key from IndexedDB, the session token will become invalid because it would no longer be able to be verified on the server. Basically, the user would get logged out in the same way as they would if they cleared out the session token by clearing cookies or LocalStorage.