How to prevent users from logging in using the old/Copied
session cookies. For example, I copy my session cookies and then logout from my website. If I import the old/copied
session cookies in another browser and refresh the page, it shows me as authenticated user without login.
How to prevent/restrict this behavior? The issue is due to
What are the additional checks that needs to be made?
Steps To Reproduce This Issue:
Go to https://www.mysite.com/.
Login to your account.
- Get the cookies using "EditThisCookie" extension
- Save the cookies, you copied in a text file.
- Logout from the account.
- Clear all the cookies related https://www.mysite.com/ from the browser
- Now Inject/Import Old Cookies to the https://www.mysite.com/ by "EditThisCookie"...
- You will be again logged In to https://www.mysite.com/ account.. using old session cookies.