In a web app, would storing a users IP address in a session be more secure then storing it without it? I think that if I store a JWT in their cookies that includes their IP address for session authentication, it would prevent attackers from being able to use another user's session token as their own because my server would check that the IP address from the request is the same as in the cookie.
Would this method make a web app more secure or is there a way to bypass these measures?
As always, when someone asks whether something is "more secure", the answer has to be "what is your threat model"? Because if you don't understand what you're trying to protect against, then you can't evaluate whether a specific control is effective.
Tying IP addresses to sessions can improve security in some circumstances, but it's usually a fairly marginal benefit, because most of the ways that allow an attacker to steal a session cookie would also allow them to bypass it.
It will also make your application less usable, especially for mobile users (for example, you'll be invalidating user sessions every time they switch between 4G and wireless, or between different wireless networks).
My solution especially for web applications would be to have 2 tokens. Access and refresh token.
Inorder to prevent users from copying a token from one browser to another check for user agent and browser name and other things like cpu.
YOu can tie the access token to ip address but have refresh token not tied to ip address but to other things like user browser properties (user agent) and when an ip address change simply check against the user agent to make sure user agent and refresh token match and in that case issue a new access token and process the previous request.
