In a web app, would storing a users IP address in a session be more secure then storing it without it? I think that if I store a JWT in their cookies that includes their IP address for session authentication, it would prevent attackers from being able to use another user's session token as their own because my server would check that the IP address from the request is the same as in the cookie.

Would this method make a web app more secure or is there a way to bypass these measures?

1 Answer 1


As always, when someone asks whether something is "more secure", the answer has to be "what is your threat model"? Because if you don't understand what you're trying to protect against, then you can't evaluate whether a specific control is effective.

Tying IP addresses to sessions can improve security in some circumstances, but it's usually a fairly marginal benefit, because most of the ways that allow an attacker to steal a session cookie would also allow them to bypass it.

It will also make your application less usable, especially for mobile users (for example, you'll be invalidating user sessions every time they switch between 4G and wireless, or between different wireless networks).

  • Also, using the ip for validation messes up people behind corporate NAT gateways where the outgoing address changes periodically.
    – user10489
    May 14, 2022 at 23:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .