Can servers store the mac address computer on the server side to prevent session hijacking?

For example, if in the server side, the servers store the mac address and the session id as a pair and compare the mac address and the session id on every request to prevent the session hijacking.

I think if that is done or doable it will be helpful and a good solution to prevent session hijacking.

Is this doable and if it is not, what are the problems that prevent that.


Using the MAC address as a condition for session termination in general

Generally a changed MAC address might be used as a weak condition to terminate sessions, but be aware

  • they can be arbitrarily faked for most network cards (so you just need to find one which makes this possible)
  • they will also change when a user is on the same device, but switches network interfaces (for example between mobile broadband, WiFi and Ethernet connection).

Servers do not know MAC addresses of clients

Anyway, learning the MAC address is not possible for a server, as the server does not receive the client's MAC address at all and cannot query for it (as long as he's not on the same network segment, which will pretty much never happen in any internet scenario).

MAC addresses are only used for data transmission on OSI layer 2 (Data link), and MAC address information of the previous sender is discarded by each router on the path as he replaces the frame headers for the next hop.

The Address Resolution Protocol ARP will not help at learning the client's MAC address either, as it's limited to the local network segment.

  • small typo (too small for me to submit an edit) in paragraph 2 under the second heading: "user" should be "used". Jan 3 '17 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.