So for years I have been using various user checks on top of the session token they are issued to maximise security.
I am now looking at developing a session system across separate servers and am wondering whether this is still relevant.
Considering Oauth does not use any of these extra checks and is widely used, can a session token on it's own been thought to be reliable? Google and Facebook would appear to think so.
The extra checks such as IP and user browser information can all be stolen just as easily as cookie if that line of attack exists.
So will it be ok to concentrate on well formed session tokens as opposed to adding the extra measures.
This page lists the typical extra measures used PHP session security
Before I get jumped on, I understand how Oauth works, but ultimately it results in a single session token for validation once the session exists.