Concurrent Session Issues

Detects missing concurrent session controls that allow multiple active sessions or fail to invalidate old sessions on new login.

zakirkun 3408a9c 2 files · 2.0 KB Updated

File contents

Concurrent Session Issues

Overview

Applications without concurrent session controls allow:

  • Multiple simultaneous logins from different locations (credential sharing detection fails)
  • Old sessions remaining valid after logout from one device
  • Session token theft goes undetected because both sessions appear valid

Remediation

  • Implement concurrent session limit (configurable per user tier)
  • On new login, optionally invalidate all other sessions
  • Provide users with a "log out all other sessions" feature
  • Track sessions per user in the database

zakirkun/ice-tea/tree/main/skills/auth/concurrent-session commit 3408a9c783

Frequently asked questions

npx skillmds@latest add zakirkun/concurrent-session-issues