Implementing Secure Multi Device Sessions with JWT Tokens

Overview

Modern users access applications from multiple devices, such as mobile phones, laptops, office systems, and tablets. If you are building a production-grade application using React, Node.js, and PostgreSQL, you must design authentication that supports:

• Multiple simultaneous device logins
• Secure logout from a single device
• Secure logout from all devices
• Token invalidation and rotation

This guide explains the architecture, database design, token strategy, logout flows, and production best practices for implementing multi-device authentication in JWT-based systems.

Why Multi-Device Authentication Is Challenging with JWT?

JWT (JSON Web Token) is stateless by default.

When the server generates a JWT, it does not store it. The token itself contains user data and expiry information.

That makes JWT scalable and efficient, but it creates a limitation:

• You cannot invalidate a specific device without tracking sessions.
• You cannot selectively log out a user.
• You cannot monitor active devices.

A pure stateless JWT is not enough for real-world systems.

To properly support multi-device login, you must combine JWT with database-backed session tracking.

Instead of relying only on stateless JWT, we introduce controlled session storage.

Flow:

User logs in →
Server generates:

• Access Token (short-lived)
• Refresh Token (long-lived)
• Session entry in the database

Each device creates its own session record.

Example:

• Mobile login → Session A
• Laptop login → Session B
• Desktop login → Session C

Each session is independently controllable.

Token Strategy: Access + Refresh Tokens

A secure system separates authentication into two layers.

Access Token

• Short lifespan (10–15 minutes)
• Sent in the Authorization header
• Contains user ID and session ID
• Not stored in the database

Refresh Token

• Long lifespan (7–30 days)
• Stored in an HTTP-only cookie
• Hashed and stored in the database
• Used only to generate new access tokens

This model provides both scalability and security.

Create a sessions table:

Why this is important:

Each login inserts a new row.
Each row represents one device session.

This enables:

• Device-level logout
• Logout from all devices
• Suspicious session detection
• “Manage Devices” feature

Login Flow

Backend steps:

1. Validate user credentials
2. Create a new session record
3. Generate a refresh token
4. Hash refresh token
5. Store the hashed token in the session row
6. Generate an access token including the session ID
7. Send:
   • Access token in the response body
   • Refresh token in an HTTP-only cookie

Example:

Including the sessionId links in every request to a specific device.

Refresh Token Flow

When the access token expires:

1. Client sends refresh token from cookie
2. The server verifies the refresh token
3. Server hashes the token
4. Server checks the sessions table:
   • Token exists
   • is_revoked = false
   • Not expired
5. If valid → issue new access token

If the session is revoked, the refresh fails, and the user must log in again.

Logout From Single Device

To log out from the current device:

Clear the refresh cookie.

Result:

• Current device logged out
• Other devices remain active

Logout From All Devices

Used for password reset or security reasons:

All sessions become invalid.

Security Best Practices

• Always hash refresh tokens
• Rotate refresh tokens on every refresh
• Use HTTP-only secure cookies
• Keep the access token expiry short
• Implement session expiry cleanup job
• Rate limit refresh endpoint
• Monitor unusual IP or device changes

Common Developer Mistakes

• Using long-lived access tokens
• Storing tokens in localStorage
• Not hashing refresh tokens
• Not rotating refresh tokens
• Not maintaining a session table

These mistakes reduce security and device control.

Conclusion

Multi-device login in JWT systems requires more than just generating tokens.

To build a secure and scalable authentication system:

• Use Access + Refresh token strategy
• Store refresh tokens securely
• Track sessions per device
• Implement selective and global logout
• Rotate tokens
• Monitor suspicious activity

This architecture supports real-world authentication requirements while maintaining scalability and security.

Drop a query if you have any questions regarding JWT and we will get back to you quickly.

About CloudThat