I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach.
The only two requirement are:
I need to know the users that are logged in and every session they have, so the user would be able to see a list with this information and be able to close any session they choose.
Both apps should use the same endpoints of a rest API.
At first I was using session cookies, and calling the API with setCredentials=true, but I found that mobile apps handle cookies differently and I don't have control over that (for example, they get deleted for various reasons before expiring). I thought about saving the cookie in native storage and appending it to every request, but I can't access the cookie in any way because httpOnly is set to true. The solution would be to set httpOnly to false, but this way I'm exposing the cookie and I'm not sure of what security measures I should put in place to protect the cookie from been stolen or tampered with.
The other solution would be to use JWT and store that in web/native storage. I would also store in a table every token still valid (hashed with a password algorithm) to get the list of users logged in and their sessions, and another table for invalid tokens for when the user chooses to end a particular session / changes password / etc. But again I'm not sure about the security measures I should us with this approach. Should I encrypt the token also? I was thinking about appending to it data about the device that ask for the token to always check that the device that asked for the token is the one using it. What other things I should do to protect this token?
If I implement correctly either of this options, which one would be more secure for both web and mobile?