We have two ways a user can buy products on our e-store. We have a mobile native app for iPhones and a mobile optimized browser experience from an iPhone default browser (i.e. Safari).

The iOS (iPhone) app establishes a HTTP(s) session on the server side after successful user login/authentication. Now at the same time the user can launch Safari browser on the iPhone or click on a product link that launches Safari browser, login and a HTTP(s) session is established on the server side. There could be two sessions concurrently established for the same user and same device. Sessions have idle time out of 20 mins and are independent of each other. My question is does this present any security risks because of two concurrent (separate) sessions for the same user from two different end points (iOS app & Safari browser) from same device?

1 Answer 1


No security issues will be caused due to two concurrent sessions on same device. As far as your server is concerned, the two sessions are two client endpoints it serves, doesn't matter where.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .