How to implement machine tagging when allowing a user to “remember me” on web application? [duplicate]

Question

This question already has an answer here:

• Stopping Session Hijacking 1 answer

The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. Meaning, by creating machine tagging mechanism to remember me should invalidate the login associated with a cookie on a different machine.

What is the best way to implement machine tagging when allowing a user to "remember me"?

Also, what information precisely would you use to machine tag? I guess It is not enough that this information be unique; it also has to be unguessable to an adversary,

This question is not referring to understand how best secure the session but looking at long-term / persistent hold with parameters of identifying the user machine characters.

Answer 1

The problem with asking a machine to identify itself is that it can lie. If an attacker can steal a cookie, there is a good chance that they can also discover any information needed to impersonate that machine.

The only (partial) exception to this is IP addresses, but when you tie a cookie to an IP address you risk annoying users when their IP address changes. Unfortunately, changing IP addresses is quite common for smartphones or laptops, and may even happen regularly for a desktop depending on the ISP. IP addresses can also be shared by multiple users, so this solution isn't 100% effective. This is a trade-off between usability and security, so the decision will depend on the application.

In most cases a cookie with the Secure and HttpOnly flags is sufficient.