Repository navigation
Device Code Flow returns same offline token for multiple devices #41636
Unanswered
bogdan-radu-coera
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
- 9342
Uh oh!
There was an error while loading. Please reload this page.
Hello,
I'm currently using Keycloak 25.0.3 and implementing OAuth 2.0 Device Code Flow to authenticate users across multiple devices (e.g., tablets, phones) from a central web app. For persistent login, I request offline tokens during this flow.
I've encountered the following issue:
When a user logs in on multiple devices using the device code flow from the same web session, the same offline token is returned for each device.
As a result, only one offline session is created for all of the devices.
If the user logs out from one device, the offline token is revoked, and all other devices get logged out too, since they all shared the same token/session.
This significantly limits the usability of the offline access feature in multi-device scenarios.
Expected Behavior
Each device login should generate a unique offline token.
Questions
All reactions