Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes.
Should I revoke all his refresh tokens?
- user is logged out of all devices, not just the one he's on currently (where he entered the wrong password)
- attacker can log out any user (from all devices)
- poor UX
The alternative is to do nothing: when the lockout expires, the user must login again on that device. He'll still be logged in on all his other devices.
What other considerations are there? Also, does anyone know what major web services commonly do?