I want to allow users of our website to restrict access to their account from devices they have explicitly authorized. This will be checked at the connection and each time the IP address changes.
To do this, I need to identify the device and I must avoid another device being able to pass for an authorized device.
I could, for example, save a UUID in a secure cookie (flags: httpOnly + secure) that the server (in HTTPS + HSTS) could check. However, via an MITM proxy, the attacker could potentially discover the token and use it as many times as he wants on several machines and even when the user is no longer connected to the infected proxy.
I think it is possible to reduce the risks by coupling this technique with a web push API call. This requires of course a browser that supports it (~ 80%) and the user agrees to receive our notifications. The idea would be that the server receiving the UUID of the cookie, sends a push notification containing a random token to the device, then the device forward the token to the server to prove that it is indeed the authorized device .
This method does not solve MITM proxy attacks, but once the person is no longer behind this infected network, the attacker can no longer spoof the device identify.
Push notifications are encrypted, but I can also encrypt[EDIT: obfuscate] the sent random token by a simple XOR operation with the UUID value of the cookie as the key.
Do you have more safest way to identify a device without requiring human action please?
[EDIT: I precise, the subscription to push notification is done only one time, and could be requested to be done from a secure network, like at home, to prevent MITM proxy while the subscription.]