Dear Okta Community,

I hope this message finds you well. I am reaching out to seek assistance regarding an issue we are facing with user login behavior in our Django application integrated with Okta.

Problem Statement:

When attempting to log in a second user immediately after the first user, the system consistently returns the details of the initial user, despite receiving a different access token. Surprisingly, this issue is not encountered when attempting the same process after a considerable delay of approximately three hours.

Relevant Context:

1. The Django application utilizes Okta for user authentication.
2. We observe the correct issuance of distinct access tokens for each login attempt.
3. The tokens retrieved exhibit the correct user details for the initial login.
4. The issue seems to persist for a specific period, approximately three hours, after which subsequent logins behave as expected.

 Code Snippet in Python (Django):

# OktaLoginAPIView for user authentication

@authentication_classes([])

@permission_classes([AllowAny])

class OktaLoginAPIView(APIView):

  def post(self, request):

    try:

      # Extracting user credentials from the request

      username = request.data.get('username')

      password = request.data.get('password')

      # Initiating Okta authentication

      authn_url = f'https://{settings.OKTA_HOST}/api/v1/authn'

      authn_payload = {'username': username, 'password': password}

      authn_headers = {'Content-Type': 'application/json'}

      authn_response = requests.post(authn_url, json=authn_payload, headers=authn_headers)

      authn_response.raise_for_status()

      session_token = authn_response.json().get('sessionToken')

      # Building authorization parameters

      authorize_url = f'https://{settings.OKTA_HOST}/oauth2/default/v1/authorize'

      dynamic_state = secrets.token_urlsafe(16)

      auth_params = {

        'client_id': settings.OKTA_WEB_CLIENT_ID,

        'response_type': 'code',

        'scope': 'openid profile email offline_access',

        'redirect_uri': settings.OKTA_PASSWORD_REDIRECT_URI,

        'state': dynamic_state,

        'sessionToken': session_token,

      }

      # Constructing the redirect URL

      redirect_url = f'{authorize_url}?{"&".join([f"{key}={value}" for key, value in auth_params.items()])}'

      return JsonResponse({'status': True, 'data': {'redirect_url': redirect_url}}, status=status.HTTP_200_OK)

    except requests.exceptions.RequestException as e:

      # Handling authentication error

      error_message = 'An error occurred during login.'

      print('Error handling login:', e)

      return JsonResponse({'error': error_message, 'status': False}, status=status.HTTP_500_INTERNAL_SERVER_ERROR)

Request for Assistance:

We kindly request your guidance in identifying the root cause of this issue and providing recommendations for resolution. Additionally, any insights into the potential reasons for the delay in behavior normalization after three hours would be greatly appreciated.