1

I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time.

Is this a potential security risk (increasing attack surface)? If so, could anyone describe a hypothetical situation in which this could be exploited?

  • Having multiple access tokens for same user active at the same time is almost unavoidable. How would you track and prevent this? You will end up managing sessions on backend. – Marko Vodopija Mar 30 at 8:21
  • @MarkoVodopija Yes, I suppose the best way would be to invalidate all other access tokens for a user in the backend as soon as a new one is created. – Wouter Florijn Mar 30 at 15:09
  • But BE will have to be aware of every session user has created ie. it has to persist every token which kind of defeats the purpose of an access token. – Marko Vodopija Mar 30 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.