Does Auth0 prevent the user to be logged in at two different places?

[James.Morrison]

Hi there @adb, I wanted to reach out about your questions and see if I can assist.

@adb

Is there any feature/way in auth0 (dashboard) to make the first token illegal .

Not currently but if you believe something like this would bring value please let us know at Auth0: Secure access for everyone. But not just anyone. so our product team can track and listen to these types of requests!

@adb

Sub-question(s) :

1. Will the access_token be valid for the next 1.5 hours ( even if the user has logged out ) .

One of our Senior engineers gave a great answer to this prior which I will quote below. Paired with our logout documented attached, it should give you what you need to concur this request in your app.

@jmangelo

Assuming the token was not leaked then only the client application has knowledge of the token which would mean removing it from storage could be enough because now no one has knowledge of the token. If you’re worried about the possibility of someone else having access to the token then that’s a different problem altogether as you would likely need a way yo revoke/blacklist the token and also detect malicious usage (the revoke functionality could then also be used at logout as an extra precaution).

Logout

Please let us know if you have any additional questions I can assist with, Thanks!