I'm currently creating a mobile app and have the following issue. I am required to only allow the user to login from a device that is registered to the users account. A user can have up to X number of devices registered at any one time.
So when the user registers and they first sign-in. I would need to register the device. Then on each request to the backend webapi, the webapi would need to verify the request came from the registered device.
How would you identify the device? Would you generate some kind of secret locally on the device and share it with the webapi?
Any ideas on how to architect this?
I'm planning to use dotnet core with identity framework for the backend and either xamarin or flutter for the front.