Malicious user gaining physical access to browser cookies (e.g., 3rd party repair guy copying cookies to his own device or something like that). Let's say legit user did not clear cookies beforehand.
Pre-authorize user device:
- Get user's browser signature via JS and save it in a db for later use (
dbCopy). This is done by an "admin" account physically present in the device before a "regular" user can use it.
Now in every HTTP request of the user, the web app will:
- Get browser sig via JS (
- Set cookie
hash = hash('sha256', currentRequestSig + randomToken)in user's browser
- Store copy of the
currentRequestSigin the app's db
- Get the cookie
- Make sure the associated
currentRequestSigof the cookie
hashis the same as
- Make sure
hashis not yet used before
hashas used in db
✓ Browser is verified at this point, user can proceed with using the app
If malicious user copies the cookie
hashto his device, it will not work because of browser sig mismatch. This assumes browser sig is hard to replicate.
If malicious user disables JS, effectively disabling steps 1-3 (an HTTP requests therefore begins in step 4 with a copied cookie), the cookie he copied will still not work because it's already used before (step 6 will invalidate it).
My question is, is this a viable solution to mitigate physical cookie theft, or is it overkill and I am missing something?