title: How to secure ASP.NET Core Web API from stolen JWT token for Impersonation
body: <p>I have a ASP.NET core REST API deployed in a Server behind IIS. REST API is consumed by Angular JS Web application and Mobile(Android/IOS) application. For Authorization I'm using JWT token(). Recently went through Security Audit and they found that JWT stored in Local storage can be stolen and used by other attacker from the same organization for impersonation(For eg, Employee utilizing Manager's features). </p>
  
  <p>I want to tag the person or that machine to that JWT so that when the JWT is stolen the attacker cannot misuse it or will not be any use with that stolen Token. I tried tagging the IP with JWT token and  stored those lookup in Server(In memory Cache). Below is the code i tried , which didn't work.</p>
  
  <pre><code>private readonly IHttpContextAccessor _httpContextAccessor;
  public TestController(IHttpContextAccessor httpContextAccessor)
  {
      _httpContextAccessor = httpContextAccessor;
  }
  var ipAddress = _httpContextAccessor.HttpContext.Connection.RemoteIpAddress.ToString();
  </code></pre>
  
  <p>I expected output to be different every time i request from different machines. But the actual output is same IP every time like this 15.11.101.25 (though i tried from different machines).  Please share with me some better solution if there is any. Excuse my English.</p>