title: Asp.Net Identity with 2FA: List of Trusted Browsers
body: <p>I'm working on a project with Asp.Net MVC 5 and Asp.Net Identity and I'm using two factor authentication. For the login I use:</p>
  <p><code>var result = await SignInManager.TwoFactorSignInAsync(model.Provider, model.Code, isPersistent: model.RememberMe, rememberBrowser: model.RememberBrowser);</code></p>
  <p>which is the default code that came with the new project. However, I also need the ability for a user to &quot;trust&quot; or &quot;remember&quot; a browser, similar to how banks can indicate if this was the first time you have signed in from a particular browser/pc.</p>
  <p>My question is around the <code>RememberBrowser</code> property on the sign in method and what .NET Identity does with this data.  I want the list of saved browsers and the ability to revoke access to one/and-or all of them. Is that possible within the Identity framework?  Also, can I tell if a browser has been &quot;trusted&quot; before by some type of lookup?</p>
  <h3>Edit:</h3>
  <p>Maybe it's a good idea to save the browser info in the database and check on login instead of the cookie? That way it can be shown as a list with the ability to delete it. What I'm looking for is what to save and how to integrate it with the Asp.Net Identity without having a security risk.</p>
  <h3>Edit 2</h3>
  <p>Here's an example from a website that is already using this:
  <a href="https://i.stack.imgur.com/I3ydb.png" rel="noreferrer"><img src="https://i.stack.imgur.com/I3ydb.png" alt="Browser list" /></a></p>
  <h3>Edit 3</h3>
  <p>Maybe this can be implemented as another step for authentication. So basically we'll have a 3 factor authentication:</p>
  <ul>
  <li>First user logs in with user/pass</li>
  <li>Then we'll check if the 2FA is enabled and get the code if necessary</li>
  <li>We get the user's aser agent and IP and check the database if it's new. Then notify if necessary.</li>
  </ul>
  <p>So I'm guessing an new cookie should be added to save browser's info. However, we should be able to invalidate this cookie along with the 2FA cookie.</p>