On the server side. You have to do something like lock cookie sessions to IPs. This is problematic on systems that frequently change IPs like on mobile networks, so it is not generally done. But it probably should be an option on high security accounts.

1: Your daily driver should not be trusted with critical accounts, it is the most likely system you use to get infected
2: Only access critical accounts from a "closed" system
2a: No remote access potential (ssh, IPMI, VNC, RPD, etc) and no services/open ports.
2b: Minimize hardware use, no USB, no bluetooth, no wifi if you're on ethernet.
3: Minimize use of the high security system - it is only used to access your critical infrastructure/accounts. It does not get random software installed. It does not leave your desk. Do not use it for random surfing or websites. Prefer stock Linux distro with a minimal desktop as a good base for the system.