This question already has an answer here:
- Stopping Session Hijacking 1 answer
The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. Meaning, by creating machine tagging mechanism to remember me should invalidate the login associated with a cookie on a different machine.
What is the best way to implement machine tagging when allowing a user to "remember me"?
Also, what information precisely would you use to machine tag? I guess It is not enough that this information be unique; it also has to be unguessable to an adversary,
This question is not referring to understand how best secure the session but looking at long-term / persistent hold with parameters of identifying the user machine characters.