In my system we have users accounts and user devices. Rules:

  1. A user can have only one user account.
  2. Each user can have many devices.
  3. A device can be bound to only one user account.

Upon initial installation, when adding new device, or after a "master reset", the user must provide the login and password to his/her account to bind this particular device to the account. After that, the device sends a unique token with each request and is recognized by that token.

So the normal situation is that Device A is bound to User A and time goes on. This question pertains to the situation later on, when a request from Device A is made using the credentials for User B.

What should happen in this situation? How should the API / server respond when it detects that a device already bound to one user account is trying to rebind itself to another account?

Let's use Dropbox as an example. What would happen when someone uninstalls the Dropbox client on one of their computers previously used with account A, then reinstalls it with credentials for account B? The local client would be pointing to a Dropbox folder containing some files but trying to sync it with an account that has a completely different set of files. Note that I haven't tested such a situation. I'm not willing to and I'm not interested in learning how Dropbox handles this; I'm only using this as an example to help describe my situation.

What I have come up with so far:

  1. Treat this as a normal situation and automatically rebind the device to the account as requested. But wouldn't this make a mess in the database in terms of what user sees or has access to (stats, data, history etc.)?

  2. Treat this as an error situation. Assume that to rebind a device to another account, it must first be unbound from its previous account. If user can't access their "old" (previous) account due to lost password etc., he/she should use the password reset form or contact support.

  3. Something different. Not mentioned above.

After doing some thinking and a little research I'm pretty convinced that option two is the best solution for me, but I'd like to know anyone foresees any major problems with this approach. Is there any reason I shouldn't follow option 2?

Edit: This system deals with non-computer devices; Dropbox is just an example. In my scenario 95% of devices are always used by the same user and are not shared among others. My assumption is that this situation can only occur as an result of error or intentional, but unsupported actions (hacking, checking what will happen if, etc.).

  • Would depend maybe. Why do devices need binding to begin with? How do you find out a device is 'bound'? (Cookies?) Are there possible errors? What are the user patterns? In our company it would be quite common that hardware is moved around between users, so if several of our employees would use your service they would have to 'rebind' once in a while at least. – thorsten müller May 22 '15 at 9:53
  • Well, I tried to make it as simple and clear as possible. Try to take the Dropbox example and do not go far beyond it. Let's say that entire system design enforces what is given in first three points -- each device must be strictly bind to any user account, and always one account per moment. And any rebind is treated as non-normal situation. Please, let's not try to turn this question into wide discussion on whether my system design is correct or not. I'm mainly looking for an inspiration, how this system should respond in this precisely described situation. Thanks. – trejder May 22 '15 at 10:14

The scenario you describe assumes that when the software is re-installed on a device, that your system will recognize that device as having been seen before. This will only happen if, as part of the registration, the device must send some hardware identification.

If you don't use such pre-existing hardware identifications, but you assign an ID after registration, then your scenario will not occur. In that case, if the software is re-installed and registered with a different account, then it will just appear that a new Device B is registered (for user B) and that Device A never connects again.

If you do use pre-existing hardware identification to identify devices, then you are putting up a serious barrier for people that share a computer (with each their own account) to use your services.

  • I do use pre-existing hardware identification to identify devices, so second scenario occurs. However, please note, that we're talking about non-computer devices. Dropbox is just an example. I'm talking about scenario, where 95% of devices is always used by one and the same user and are not shared among others. And described situation could (per assumption) only occurs as an result of error or intentional, but non-standard actions (hacking, checking what will happen, if, etc.). – trejder May 22 '15 at 12:02
  • 1
    @trejder: If there is no valid (business) scenario in which a previously registered device would migrate to a different user, then it is simple: generate an error if it does occur. – Bart van Ingen Schenau May 22 '15 at 16:05

A lot of questions of this kind depend heavily on the actual business domain, and it's not clear that we have enough information to make a good decision.

any rebind is treated as non-normal situation

This comment suggests that it may make the most sense to send back a error response (e.g. 400 Bad Request) with a description of the reason you're not processing the request.

Having said that, is there any real benefit in requiring a manual process to deal with this situation? Do you for example require some kind of audit to determine if the device transfer is valid? Is the information that the user works with in your application tied to the device to an extent that you want to protect that information from another user who may not have authorized access to the device? In other words, the answer really depends on your business rules.

As an example to show that the answer depends on the business, in a system I'm working on we also link a unique device ID (mostly for phones) to a user account. If we receive a request from a device for a different user account than it is currently linked, we rebind and move on, because specific device ownership isn't really relevant in our system, only that it is bound to some account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.