I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time.

Is this a potential security risk (increasing attack surface)? If so, could anyone describe a hypothetical situation in which this could be exploited?

  • Having multiple access tokens for same user active at the same time is almost unavoidable. How would you track and prevent this? You will end up managing sessions on backend. Commented Mar 30, 2019 at 8:21
  • @MarkoVodopija Yes, I suppose the best way would be to invalidate all other access tokens for a user in the backend as soon as a new one is created. Commented Mar 30, 2019 at 15:09
  • But BE will have to be aware of every session user has created ie. it has to persist every token which kind of defeats the purpose of an access token. Commented Mar 30, 2019 at 18:10


You must log in to answer this question.

Browse other questions tagged .