Preventing cookie replay / cookie use by more than one client
问题 What is the "best practice" to prevent a valid cookie from being used by more than one client at a time in ASP.NET MVC? In this scenario, we are using all the OWASP tricks. Strict HSTS: HTTPS/SSL on every page Cookies are listed as HTTPS-only Cookies are marked secure Cookies have a short expiration There is also code to prevent cross-site request forgery (XSRF) from altering values page to page. That's all great and prevents users from changing values, but it doesn't prevent a bad actor from