3 ms·
To get around this, one could include the request IP address in the JWT and required a refresh token to be sent when the user's IP switches.
by iratewizard 5y ago
To get around this, one could include the request IP address in the JWT and required a refresh token to be sent when the user's IP switches.
- secureleaf 5y agoThis is not a safe method for protecting against this type of cache vulnerability. IP addresses are regularly shared by multiple users, especially when behind NAT (even mobile ISPs are doing carrier grade NAT these days).
- iratewizard 5y agoSo there should be no fail safe since it can't be guaranteed to work in every scenario.
- remram 5y agoIn this context, this would just prevent everybody from logging in. The JWT would correctly get rejected but people would still be getting the wrong token from the CDN over and over.
- iratewizard 5y agoWhich would you rather? The situation you just described or users accidentally spoofing each other's session?