4 ms·
Whats the drawback for just including the ip in jwt and revoke if either time is up or ip change ?
by rawoke083600 4y ago
Whats the drawback for just including the ip in jwt and revoke if either time is up or ip change ?
- nkristoffersen 4y agoI would imagine it would be a very poor user experience. Especially on mobile, where you jump around 4G/5G/WiFi networks and get a new IP address each time.
- deepstack 4y agoor if the user allows JS in their browser, then just do some GPU/CSS/Font Collections,etc. finger printing and get the unique id, since all the major bowser vendors are not fixing this problem (except may be for webkit).
- lakomen 4y agoThe IP can change, is not guaranteed unique (many people can be behind 1 IP). Imagine unstable mobile connections going over 4/5g or random wifi as you move.
- Awerion 4y agoBest things would be webauthn were you have crypto hardware like your smartphone
- notimetorelax 4y agoIP can change multiple times when switching between mobile stations and wifi hotspots. Plus IP may change for each new TCP request if your operator uses CGNAT
- xxs 4y agoyou can have multiple IPs at the same time. The "IP changes" is a common fallacy - even the mobile IP depend on the datacenter(s) process it. There is no grantee there will be a designated aliasing, and effectively there could be multiple IPs for the same client interleaving.