Skip to main content
Information Security

Return to Answer

deleted 115 characters in body
Source Link
schroeder ♦
schroeder ♦
  • 132.1k
  • 55
  • 307
  • 348

User security is governed by two systems:

  • Login credentials: Here, if someone steals the user's password, disallowing concurrent logins (new devices not accepted), will help. But a better idea is to have 2fa. If the user intentionally shares their password, then there is very little security benefit from allowing just on concurrent login (since the user can logout and let the other person login).

  • Session management: Here the biggest risk is that session tokens can be stolen. In this case, multiple devices will use the same session, so to your backend, that's still just one concurrent login. In order to protect against that, you should checkout a solution like SuperTokens.io.

User security is governed by two systems:

  • Login credentials: Here, if someone steals the user's password, disallowing concurrent logins (new devices not accepted), will help. But a better idea is to have 2fa. If the user intentionally shares their password, then there is very little security benefit from allowing just on concurrent login (since the user can logout and let the other person login).

  • Session management: Here the biggest risk is that session tokens can be stolen. In this case, multiple devices will use the same session, so to your backend, that's still just one concurrent login. In order to protect against that, you should checkout a solution like SuperTokens.io.

User security is governed by two systems:

  • Login credentials: Here, if someone steals the user's password, disallowing concurrent logins (new devices not accepted), will help. But a better idea is to have 2fa. If the user intentionally shares their password, then there is very little security benefit from allowing just on concurrent login (since the user can logout and let the other person login).

  • Session management: Here the biggest risk is that session tokens can be stolen. In this case, multiple devices will use the same session, so to your backend, that's still just one concurrent login.

Source Link
Rishabh Poddar
Rishabh Poddar
  • 144
  • 2

User security is governed by two systems:

  • Login credentials: Here, if someone steals the user's password, disallowing concurrent logins (new devices not accepted), will help. But a better idea is to have 2fa. If the user intentionally shares their password, then there is very little security benefit from allowing just on concurrent login (since the user can logout and let the other person login).

  • Session management: Here the biggest risk is that session tokens can be stolen. In this case, multiple devices will use the same session, so to your backend, that's still just one concurrent login. In order to protect against that, you should checkout a solution like SuperTokens.io.