3 ms·

So your goal is to prevent cookie theft, not to figure out how to get token regeneration to work. What makes you think this is a problem for your app? What el

So your goal is to prevent cookie theft, not to figure out how to get token regeneration to work. What makes you think this is a problem for your app? What else have you thought of to solve the issue? One idea would be to concat the cookie token and the IP of the requestor - that would eliminate the "cookie was stolen and used from another IP". Or you could use a browser fingerprint here.

3000 3y ago
the problem only came to me when i had multiple post requests queued up due my internet connection being up and down, and then only one of them having a valid token (as that one, regenerated the token and invalidated the requests after) and yes, im doing along with https of course, to prevent cookie theft. locking the cookie to the IP is/will be an option in user settings. decided to leave it as an option as for say mobile devices that could get very annoying if it was forced.