bug: Store ips of the user in the db along with token, make sure token is valid for that ip

[hkirat]

If someone steals my jwt, they should not be able to access my dashboard we should check if the ip is the same as the one they logged in with

[ItsFlash10]

on it, trying

Edit: done here #1162

[farjad-akhan]

On it! #trying

[MeerUzairWasHere]

@hkirat We have to add model for IP, where we save all ips or just one more column in user table? and we can stop him to login if ip are not same? but we have to remove the ip from db when user logout from that device?

[nawinsharma]

@hkirat , do we need to save ipAddress in session or userschema?

[devsargam]

@hkirat do we want this? really

[rishav-goswami]

If someone steals my jwt, they should not be able to access my dashboard we should check if the ip is the same as the one they logged in with

Hey @hkirat and @devsargam ,

Instead of IP tracking we should use http-only cookies for JWT storing and its combination with CORS. Which can mitigate the mentioned issues of stealing JWT and accessing content.

pov:- In case if JWT is stolen even with this implementation then attacker is not able to access dashboard because he can't set the cookie to our origin, ultimately CORS will effect if he tries from other origin

I can work on this If its resolves what you mentioned.