APNS device tokens combined with Login/logout system

Question

I have an iOS application where users can log in and out with different accounts. (These accounts are specific to our Service).

I am also using APNs to push notifications from my backend server to the application, when something intreresting has happened.

The following scenario describes my problem:

• User A starts the App and Logs in. A Device token is generated and sent to the server.
• User A logs out of the App
• User B Logs in to the App
• The Backend Server sends out a notification to the device that "belongs" to user A. However, User B is logged in to that device now. (They share the same device token)
• User B "receives" the notification. (I.e the phone shows the notification despite that it's not applicable to the current account).

Has anyone solved a similar problem? I can think of several solutions such as:

• Refreshing the device Token manually. (I don't know if it's possible)
• Receive the notification - Butonly showing it if the intented user is logged in. However, I don't think this is possible, since the system is in charge of showing the notification and not my app.
• Change the backend so that the user has to tell it when it's online and offline and not send notifications when it's offline. (This solution would cause many problems and I don't think it would work completely either, so I want to avoid this).

None of these solutions seems optimal and I haven't found anything better. I think that for example Facebook must have solved a similar problem and probably many others too.

Thankful for some input on this.

FYI. I will face the exact same problem on Android, but I have chosen to separate the Questions here on Stack Overflow.

Answer 1

did you find the silver bullet for the issue? The way we resolved the problem is the following:

• A logs in and uploads its token to our backend and store it in the keychain (or userdefaults).
• If A logs out correctly, we invalidate its token.
• If the app was deleted APNS will notify our backend that the token is invalid. (when a notification is sent)
• When B logs in we upload the token to the server since it already exists in the keychain (or userdefaults) then the server makes sure that the token only belongs to a single user.

When logging out we unregister from remote notifications to make sure no push notifications will be received.

UIApplication.shared.unregisterForRemoteNotifications()

P.S.: The Android part is easier because you can access the token at any time through the lifecycle of the app, therefore, you don't have to store it manually.

Answer 2

The 3rd solution is the good one. You just need to delete the installation object in your backend when the user logs out, and create a new one at log in.