This question maybe felt as old school. Still i am in a hypothetical scenario where I will explain in detail below. And Take into consideration that my application is used by millions of users concurrently (hope so 🙂

Scenario :

I have login module, when i am using JWT to authenticate and authorise the user for any API access to my gateway server. Here When user login, I fetch user details from db and confirm the normal user validation and then generate JWT access token and refresh token. This token is share with my client (UI). Whenever they do API call to server, then will send this access token to the gateway server and server will validate the token (including expiry and all) and allow the user to access the gateway resource. So, now i am entering to my actual area of doubt, when concurrent user login of same account, how should i handle? Currently i am not storing any token information with me (neither in db nor in memory) To handle this scenario i am expecting like, when a second login request comes from same user, we ask the user that “already user is logged in, do you want to continue?” , if that user say “yes”, we allow the user to login and we need to logout the old user wherever they are using the UI. Since JWT is stateless , i ended up in a doubt like this.

The catch here is ,i have huge number of user. How can i handle this scenario in efficient way. Can’t compromise my application performance.

I saw similar question like this in this platform itself, but i could not figured it out from the responses. If someone can explain it in better terms by considering performance and standard we follow in globally, that would be really appreciated..