I'm trying to build an API with Flask. I want to have an authentication system like Facebook, twitter, etc. have.
I want to use JSON Web Tokens. The frontend will be built with React let's say.
I have researched and found one answer how to issue and verify JWTs.
However, the main concern is how to let users use multiple sessions on multiple devices? How to renew sessions/tokens when user logouts? How to issue refresh tokens?
If there are other bits I'm missing, please help me with them also.
#Help regarding login system
inner monolith
oblique stream
However, the main concern is how to let users use multiple sessions on multiple devices?
Store device id along side refresh tokens
When user logins from new device just generate new token pair
When user tries to use refresh token check if device id is the same
How to renew sessions/tokens when user logouts?
When users logout front will delete tokens from storage
On new login - issue new token pair, delete old refresh
How to issue refresh tokens?
Refresh token can be a simple uuid (or even better a jwt with this uuid in payload)
Save this uuid, device id, user id, expires at date
When refresh expires delete it
inner monolith
Good idea
I'll try this approach.
What about different browsers on the same device?
