So I'm working on adding an alert to our web application when a user logs in from an unknown device. I'm trying to figure out the best way to actually detect the unknown device, and what the industry standard is.
I initially thought about using cookies, but the user would still get the warning if they used a different browser or simply cleared their cookies. My second thought was storing their IP in the database and checking against that, but their IP could change as well.
Any ideas? What do companies like Facebook, Google, etc. do when they generate these warnings?
Generally, login systems keep a track of the following
Whenever a user logs in, the system checks for these combinations. If any of the information has changed, the system will send a notification to the user.
Check Baeldung's article for reference