I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good.
However, should I verify more info about the user's previous sessions, too? For example, keep track of the city or something that a user logs in from (if it is not a mobile device login, save that on the server too)
I know user-agents can be easily spoofed, but it seems that if an attacker happens to get a hold of the user's device-specific ID there would be some serious issues.
Any insight would be greatly appreciated!