is it possible to restrict a token to one device ?

Question

在.NET环境中-基于令牌的身份验证-是否可以将令牌限制为一个设备，以便某人无法复制该令牌并在另一设备上使用该访问令牌执行请求？

Answer 1

Short answer is yes.

1- The naive solution is, you get the User-Agent from request header as well as client ip address, concatenate them with the token and encrypt it with a SecretKey and return the whole string as a new token to the client, so every time client sends a request to server you have to decrypt the token based on the SecretKey and check the data with the coming request ip address and User-Agent. so in case if any one copy the token it will not match with the headers or ip. but if the client pass the entire header properly and has the same ip address as the original client you are hacked!

2- The safest solution is client certificate authentication as NightOwl888 mentioned