We have two ways a user can buy products on our e-store. We have a mobile native app for iPhones and a mobile optimized browser experience from an iPhone default browser (i.e. Safari).
The iOS (iPhone) app establishes a HTTP(s) session on the server side after successful user login/authentication. Now at the same time the user can launch Safari browser on the iPhone or click on a product link that launches Safari browser, login and a HTTP(s) session is established on the server side. There could be two sessions concurrently established for the same user and same device. Sessions have idle time out of 20 mins and are independent of each other. My question is does this present any security risks because of two concurrent (separate) sessions for the same user from two different end points (iOS app & Safari browser) from same device?
