How do you prevent JWT hijacking using stored fingerprints?

Question

Our team has been asked to prevent JWT hijacking in our API. Our solution has been to store a "fingerprint" of the user's IP and user agent in our database and validate that on each request. When the user logs out, we delete the fingerprint.

There are some problems with this:

users often don't logout
users IPs change

If a user doesn't logout, their fingerprint will remain. When they come back to the application, if their IP has changed, they won't be able to login, because it appears they are a hijacker.

What is the best approach to implement this kind of fingerprinting? Should we not be using the user IP?

So if your users don't log out then you should implement a timeout that limits the open window for that token to be live. Login should generate a new token handshake so your fingerprint would renew with new values, it shouldn't prevent login as that is the time you are authenticating your user. Is there somethign to prevent you from standard timeouts? — scrappedcola
– scrappedcola, Commented Nov 14, 2024 at 16:14

Anubhav Sharma · Accepted Answer · 2024-11-14 16:07:13Z

0

Use cookies. When user logs in, send cookie with proper domain with name lets say "auth-cookie". It will contain your jwt token. These cookies will be automatically sent back to you everytime user sends a request. Set httpOnly field to true so that hijacker cannot read the token using javascript. On logout, set the "auth-cookie" cookie to blank.

answered Nov 14, 2024 at 16:07

Anubhav Sharma

5781 gold badge4 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How do you prevent JWT hijacking using stored fingerprints?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related