Which feature of PingAM protects against cookie hijacking in a cross-domain single sign-on environment?

In a cross-domain single sign-on (CDSSO) environment, the session cookie is passed between different domains, increasing the risk of hijacking. PingAM's "Restricted Tokens" feature mitigates this by binding the session to the client's IP address. When this feature is enabled, PingAM records the IP address when the session is created. Subsequent requests using that session cookie must originate from the same IP address. If a request comes from a different IP, the session is invalidated, thus preventing a hijacked cookie from being used by an attacker at another location.

A: Session tokens are random by default to prevent guessing, but this does not protect against the use of a stolen (hijacked) token.

B: "Bound tokens" typically refers to cryptographic binding of tokens to the TLS layer (as in Token Binding), which is a different mechanism.

C: "Lockout tokens" is not a standard PingAM term for session protection; it relates more to account lockout after failed login attempts.

Ping Identity, PingAM Documentation, "Authentication and SSO," Chapter: "Configuring single sign-on," Section: "Validating Client IP Addresses for CDSSO." The document states, "AM can be configured to validate that the client IP address in a request is the same as the one stored in the session. This feature is known as restricted tokens."