MOHAN
70701aa124
Session IP and user-agent were enforced as an exact-match gate on every authenticated request and on refresh: any mismatch threw Invalid session binding / Session binding mismatch and forced a logout. In production this made the app nearly unusable, because real users' IPs change constantly and normally in ways that have nothing to do with account theft — mobile network handovers, corporate NAT pools, VPNs, CDN edge changes, Wi-Fi/cellular switching. The still-enforced single-use rotating session nonce plus refresh-token rotation and revocation already prevent a stolen token from being replayed on another device, so the hard IP/UA gate was mostly adding false-positive lockouts rather than real security. Now IP and user-agent changes are recorded as a SESSION_BINDING_DRIFT abuse event (feeding the existing risk-scoring system) instead of rejecting the request, so the security signal isn't lost, it's just no longer a blanket block on legitimate use.