I am getting familiar with authentication (using passportjs) and using things like sessions, jet, etc.

My question is what is the best way to prevent someone from going on a computer and copying a sessionid/token/jwt/etc. and entering it into the website on their browser and getting unobstructed access into the user's profile.

Is there a technique that makes this not possible? I've looked into browser fingerprinting and not sure if that's a good idea since browsers often change navigator attributes.

Also, I code with JS so preferably that language.

  • Your tokens are sent in headers of the HTTPS request. So even if you protect them at the browser, someone can see the network request.
    – Limit
    Mar 14 at 17:55
  • The protection mechanisms are configured in your framework settings in the terms of token expiry and scope.
    – Limit
    Mar 14 at 17:56
  • 1
    So in terms of someone going and simply copying the token using dev tools (like on your physical machine) and hijacking the token, there is no technique to alleviate that / would that be out of the scope of the app itself to protect? Mar 14 at 17:59
  • one thing you can do is not rely on the session for profile changes. Require the user to re-login/authenticate when changing password, email, username, or anything else that should be protected... that way they can steal a session, but not the account. (without knowing the password...) Many sites do this... especially when making a purchase.
    – pcalkins
    Mar 17 at 19:57

I think this is really out of scope of your application code. If a malicious user is able to steal session information by having physical or other access to the victim's computer, all assumptions about security are off. Even if you were to prevent stolen session information from being used, what's to stop the attacker from stealing credentials instead? Or simply just using the already logged-in session on the victim's computer? Maybe the victim's browser could be remotely hijacked to communicate with your service on the attacker's behalf.

That said, there are sometimes mechanisms used that will flag when the session's IP address changes, or there is a log on from a new location. However, these things also come with a negative user experience, so it is up to you to balance that if you choose to implement any of them. This would need to be server-side logic in any case.

  • "If someone gets to your machine, this is not anymore YOUR machine" :-) Mar 17 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.