---
title: "Notice when a session cookie moves to · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/stolen-session-detection
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Notice when a session cookie moves to another device

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: ACC-66
- Level: Recommended
- Chapter: [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)
- Rule: Save the device context with each session and compare it on every sensitive request. When the browser family, the platform or the country changes, end the session and ask for a full sign-in.
- Applies when: The project has user accounts.
- How: Malware that steals cookies skips the password and the second factor. The OWASP Cookie Theft Mitigation Cheat Sheet advises saving the user agent, Accept-Language and network signals at sign-in. Save the browser family, the platform, the language and the country derived from the IP address, not the address itself. A minor browser update or a new address in the same country is normal, so let those pass. A CAPTCHA proves nothing here. Ask for the password or passkey and the second factor, and record the event in the [security log](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/security-activity-log). Where the browser supports Device Bound Session Credentials, a W3C draft, bind the session to a key the device keeps. A copied cookie then cannot be renewed elsewhere. Keep the limits from [lock down session cookies](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/session-cookies).
- Check: On staging, sign in from a test Windows browser in one country. Replay its cookie with a Linux user agent from another country. The first sensitive request answers 401 and the security log gains one event. The same cookie with only a newer browser version still works.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export const isSameDevice = (saved, current) =>
  saved.browserFamily === current.browserFamily
  && saved.platform === current.platform
  && saved.country === current.country;
```

### Python example

```python
def is_same_device(saved: dict, current: dict) -> bool:
    return all(saved[key] == current[key] for key in ("browser_family", "platform", "country"))
```

## Sources

- [OWASP Cookie Theft Mitigation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cookie_Theft_Mitigation_Cheat_Sheet.html)
- [W3C Device Bound Session Credentials](https://www.w3.org/TR/dbsc/)

## Related rules

- [Show people their own security log](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/security-activity-log) in Accounts
- [Lock down session cookies](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/session-cookies) in Security testing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/stolen-session-detection">Agent Wranglers accounts playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Let organisation owners sign a member out](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/owner-ends-sessions)
- Next: [Keep a way to sign everyone out at once](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/sign-everyone-out)
- [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)