I'm currently developing a REST API which is supposed to be consumed by my App and desktop website. The user should not need to login every single time.
Currently I implemented the following:
- First call to auth with username&password -> master token is returned (valid for 1 month) and stored in the DB. On client side, it's stored in local storage.
- Call to access token endpoint with master token. Check if expired, if not check in DB if it's revoked by the user. Return 15 minute access token
- Every secure resource needs the access token. If it's expired, the client needs to provide the master token to the access token endpoint again.
If the master token expired, a new login is required. By the way, how would I do that without disrupting the user flow? Let's say he creates something and just at that moment the master token expired. Simple login popup?
Real question is: Let's say the user uses the incognito mode to Login. I create a master token in the DB. The user closes it. Since no logout happened, the refresh token stays in my database until it's really expired (1 month). if my users use a lot of these modes, the database may hold many master tokens which might never be used (since they aren't remembered by any application). Is there a flow to deal with that? Or just live with having them in the database?
Seems to be a bit confusing if you have tons of signed in devices in the "Signed In Devices" list.