This question is inspired by this answer and question

I also use that method to handle the case where users can sign in and out of multiple devices, by storing a per-device refresh token for a device id. I am making the assumption that various additional checks should be available to refresh token exchange: check IP for web apps, check device id for mobile apps, throttling etc.

I would have thought that OIDC somehow caters for the flows around multiple devices for a single user, but having tried to study the spec I can't say I see it. Basically, my question is, does OIDC implicitly or explicitly address this stuff? Am I reading it right there is no support for this and that to handle it a custom non-OIDC approach is necessary?

  • Why do you think that you can only have one refresh token per user per client? I don't think OAuth specifies any limits there. It's up to your implementation to manage the refresh tokens. I'm pretty sure having multiple refresh tokens is allowed, but I haven't found a source backing that up so far...
    – xsrf
    May 1, 2021 at 14:57


You must log in to answer this question.

Browse other questions tagged .