I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good.

However, should I verify more info about the user's previous sessions, too? For example, keep track of the city or something that a user logs in from (if it is not a mobile device login, save that on the server too)

I know user-agents can be easily spoofed, but it seems that if an attacker happens to get a hold of the user's device-specific ID there would be some serious issues.

Any insight would be greatly appreciated!


You should only store a single login token on the user's computer. Nothing more. That token should be created after verifying the user's credentials through a secure login process. The token should expire at some point. On the back end, that token should be associated with all of the user's info. It's generally acceptable to use the user's email address as their login. You should verify the user's email before granting them access to your system.

Also, you can keep track of the IP address or Cities that the user logs in from. That's your perogative. Keep in mind that some users consider tracking their IP to be a violation of their privacy. However, lots of sites track IP now anyway, so it's not as big a deal anymore.

Some systems, like Google, track IP addresses and user-agents. But I would suggest starting with keeping track of the bare minimum, and grow as your needs grow.


The amount of protection and verification you add should be acceptable for the value of the data you are storing. If you don't trust your own data in the system, odds are that you need more security.

  • 2
    That's not what I'm saying at all; I'm talking about the user's security here. How much should I store about the user, and how much should I verify? Oct 20 '15 at 22:53
  • Event though the answer is very generic, it's correct.
    – dmaij
    Oct 21 '15 at 0:09
  • @dmaij I agree with it, but it isn't what I'm asking. I'm asking, for the user's security, how likely the login should be marked as an attacker. Oct 21 '15 at 1:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.