So I had this idea, you have an app, and someone hijacks your session.

What if servers determined if your browser session is valid based off hashed stored fingerprint data.

The login session itself starts with a client side generated key, that key is used as a salt to hash your fingerprints with SHA-256.

The key and hashed fingerprint data are both sent to the server, the server validates it by checking if enough of the fingerprint hashes match with the key, and either blocks you or allows you in.