I have to verify that the user has registered and is currently logged out without identifying the user. Essentially, I am looking for privacy-oriented authorization mechanisms which prevent simultaneous user sessions.

  • $\begingroup$ Keep a list of active session tokens on the server. Delete the token when a user logs off. $\endgroup$ Jun 18 at 17:30
  • $\begingroup$ @SAIPeregrinus How to generate token without identifying the user? The token should be different for all users. $\endgroup$
    – tejasvi88
    Jun 19 at 3:06
  • $\begingroup$ The token is generated on login. It IDs the user, since that's inherent in having users who can log in. If you don't want to ID users you can't have users in the first place. Of course these IDs don't have to be connected to any outside identifying information. $\endgroup$ Jun 20 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.