I could login through the website, android app, iOS app, the browsers on mobile, and when I log out from one, it doesn't log me out of all of them. Traditionally, you would log out of all the services at once because your auth_token would be set to null in the DB. That being said, I don't see a way to do this through Rails and Devise.
I only have two solutions so far.
The first one is to have separate session tokens, and figure out which to use based on a header. However, if you want unlimited number of sessions, you need some unique ID to follow through on. I'm not sure how you'd achieve this.
The second solution is to have a counter in the DB named sessions. It keeps track of how many sessions you currently have logged in. If I'm logged in through the website, Android app and iOS app, it would be 3. Whenever you have more than 1 session open and log-out, the number of sessions would be decremented. If the number of sessions becomes 0, we set the auth_token to null in the DB (nil in Ruby).
The only loop-hole I could see in this is that if someone logs out, is still logged in on some other platform, and is code savvy, they could find the auth_token via previous requests on their browser. Then, they could send it in and continue to use it even though they have technically logged out. I don't necessarily see a problem with this, but I don't know if this is a good way to do it.
Does anyone else have a good suggestion? Is there a better place to post this?