Tag Info

New answers tagged


The only reason you would not be able to track this is if the tokens are shared across devices. That's probably not something that should be done but it is really up to the implementor of the clientside application to secure that part. So you can't really force this. When the user authenticates they can send an identifier of the device they are logging in ...


In ASP.NET MVC, there are attributes that you can apply to the Controller methods that divert calls to an Unauthorized controller if the user isn't authenticated. This makes sense to me, since you want to catch intrusion attempts very early in the process. If the user isn't authenticated, the controller method doesn't even execute. Once the user has been ...

Top 50 recent answers are included