News for hackers. Stuff that matters.

A comment on Modeling your App's User Session. Parent comment

Re:Modeling your App's User Session by jeffasinger on Friday October 18, 2013 @07:05PM (#6574543)
One technique is to hold other information along with the session cookie, such as the client IP.

This isn't perfect, because there will be false positives that log people out fairly often, but it would make session hijacking significantly harder.

[ Parent | on HN ]
Re:Modeling your App's User Session by simonw on Friday October 18, 2013 @07:24PM (#6574608)
I use a laptop and carry it between work and home, occasionally signing in to a VPN. My IP address changes several times a day.
[ Parent | on HN ]
Re:Modeling your App's User Session by woadwarrior01 on Saturday October 19, 2013 @01:01AM (#6575406)
Add a hash of the userAgent in the session. How about adding some shared secret in the browser's localStorage?
[ Parent | on HN ]