Concurrent Session Issues

Detects missing concurrent session controls that allow multiple active sessions or fail to invalidate old sessions on new login.

zakirkun Updated

File contents

Concurrent Session Issues

Overview

Applications without concurrent session controls allow:

  • Multiple simultaneous logins from different locations (credential sharing detection fails)
  • Old sessions remaining valid after logout from one device
  • Session token theft goes undetected because both sessions appear valid

Remediation

  • Implement concurrent session limit (configurable per user tier)
  • On new login, optionally invalidate all other sessions
  • Provide users with a "log out all other sessions" feature
  • Track sessions per user in the database

zakirkun/ice-tea/tree/main/skills/auth/concurrent-session commit 3408a9c783

Frequently asked questions

npx skillmds@latest add zakirkun/concurrent-session-issues