Token based authentication in REST APIs
<p>I trying to implement a token based authentication approach:</p>

<ol>
<li><p>Every successful login creates new token. </p></li>
<li><p>If user selects "keep me logged in" or the user is using a mobile device, the token is persisted in a Redis database without an expiration date. Otherwise, the token will expire in 20 minutes.</p></li>
<li><p>Once user is authenticated, the token is checked from each subsequent request in my Redis database.</p></li>
</ol>

<p>I'm wondering how I can identify devices. In case of mobile devices, I can use a device identifier. But how can I identify a browser?</p>

<p>Example: The user logs in using Chrome and selects "keep me logged in". A token is generated and persisted with the browser name in Redis. If the user logs in from Firefox, saves the token and "Firefox" in the database. I save the token in Redis whereas token is created on successful authentication. Is it fine to persist only the token and the browser where the token is being used? Or do I need to persist the IP as well?</p>

<p>Additional question: How to avoid attackers to steal the token from a cookie?</p>