I’ve a token based authentication system (REST) that I inherited for an iOS app (can’t change), and I’ve to re-use the same authentication web api system (that I can change to adapt for the web requests while still accommodating iOS app).
Here’s how the authentication system works.
-
username, password -> if valid a token is returned to the user and also saved to the database
-
getNewToken -> passes the old authToken, web api verifies from the table, issues a new token, updates the database table
1 is triggered by user login while 2 is automated interval based call every 15 minutes by the iOS app (I guess to keep the session alive, like heart beat)
Now when user is on the web and logs in, I call #1 to get the token but then if user is already on the device, the old token at device won’t work because it got updated on the server as a result of user signing on the web.
This makes me wonder and in the light of above scenario my question is how multiple sessions are handled using authentication token system out there in real life, for instance I could open gmail or Facebook in two different browsers and both sessions are maintained (I’m not sure if they are using token based system or some other but let’s say they are for an example). Please advise.
10
Yes if id is id of the device cause you need to store device id in some place. If you can install programs on the server better to store login tokens not in database but in some external key value storage like redis or memcached, if you can do it of course.
22