Store IP during signups, restrict tokens to IPs

[hkirat]

right now tokens can be shared and multiple people can login
Restricting by IP should help in protecting that

[EswarPranavNadhHari]

what if users switch between Wi-Fi and mobile data? won't it be a problem

[randomboy24]

We can add the user's IP to the JWT payload when the user logs in and implement middleware to match the IP from the incoming request with the IP in the JWT payload. If they don't match, the user will be logged out

[IkramBagban]

right now tokens can be shared and multiple people can login Restricting by IP should help in protecting that

Hey Harkirat, I was thinking to open this issue, but I noticed that you have already opened it. I also thought about the solution of restricting IPs to prevent multi-login. However, there is a problem: IPs often change. This means users would have to log in repeatedly whenever they switch networks, which might not be an ideal solution.

I was researching on this some days ago and I have found a solution. We can use device and browser fingerprints to ensure that a device can only be logged in at a time by storing the device and browser's details. Such as resolution, user agent etc. this way we can make sure one user login at a time.

I would love to work on it if you could assign this task to me.

[IkramBagban]

right now tokens can be shared and multiple people can login Restricting by IP should help in protecting that

Hey Harkirat, I was thinking to open this issue, but I noticed that you have already opened it. I also thought about the solution of restricting IPs to prevent multi-login. However, there is a problem: IPs often change. This means users would have to log in repeatedly whenever they switch networks, which might not be an ideal solution.

I was researching on this some days ago and I have found a solution. We can use device and browser fingerprints to ensure that a device can only be logged in at a time by storing the device and browser's details. Such as resolution, user agent etc. this way we can make sure one user login at a time.

I would love to work on it if you could assign this task to me.

@hkirat @devsargam

please check the pull request[ #1642 ]. I've added detailed explanation of what I am doing to resolve this issue.