server/AyaNova/Controllers/AuthController.cs

@@ -193,7 +193,7 @@ namespace AyaNova.Api.Controllers
                     DownloadToken = DownloadToken.Replace("+", "");
                     u.DlKey = DownloadToken;
                     u.DlKeyExpire = exp.DateTime;
-                    await ct.SaveChangesAsync();
+
                     //=======================================================
 
                     var payload = new Dictionary<string, object>()
@@ -213,6 +213,10 @@ namespace AyaNova.Api.Controllers
                     //issue tokens as well, but it looked cmplex and this works so unless need to remove in future keeping it.
                     string token = Jose.JWT.Encode(payload, secretKey, Jose.JwsAlgorithm.HS256);
 
+                    //save auth token to ensure single sign on only
+                    u.CurrentAuthToken = token;
+                    await ct.SaveChangesAsync();
+
                     log.LogDebug($"User number \"{u.Id}\" logged in from \"{Util.StringUtil.MaskIPAddress(HttpContext.Connection.RemoteIpAddress.ToString())}\" ok");
                     metrics.Measure.Meter.Mark(MetricsRegistry.SuccessfulLoginMeter);