OAuth2 Multiple sessions (devices) on same client id
<p>For our mobile app we're running an API which uses OAuth2 for user and client authentication. We're using a stripped down version of OAuth which does not use scopes or client grants since the only apps that will be using the API are written by us. Each app (Android and iOS for now, but planning on web app and more mobile) has an own Client ID and a Client Secret and until recently we allowed each client to only have one session per user. This however raises a problem when a user has an Android phone and Android tablet. The way our API works now is that when the user is logged in on his phone and then tries to sign in on their tablet, the phone session will be deleted. We could simply remove the constraint of one session per Client, but we also do not want multiple sessions per device (2 sessions on the same phone)</p>

<p>My question is, how can we allow multiple sessions (devices) per Client while still being able to identify the individual devices? (I still want only one session per device).</p>

<p>We're considering generating a unique hash on the client upon client authentication which is shared to the API and stored on both the client and the API. There must however have already been people with this particular problem and I'm curious to their solutions (and I obviously haven't found any satisfying answers searching online).</p>

<p>Many thanks.</p>

<p>Some implementation specifics:</p>

<ul>
<li>NodeJS API</li>
<li>Passport &amp; oauth2orize OAuth implementation</li>
<li>ResourceOwnerPasswordStrategy (for authenticating a client and user in one) &amp; ClientPasswordStrategy (we also support FB login so we still need to authorize the client when doing that)</li>
<li>Bearer tokens</li>
</ul>