I am getting familiar with authentication (using passportjs) and using things like sessions, jet, etc.
My question is what is the best way to prevent someone from going on a computer and copying a sessionid/token/jwt/etc. and entering it into the website on their browser and getting unobstructed access into the user's profile.
Is there a technique that makes this not possible? I've looked into browser fingerprinting and not sure if that's a good idea since browsers often change navigator attributes.
Also, I code with JS so preferably that language.