Users sometimes get logged into the wrong account

[JohnGoodman]

In very rare instances, when a user has been logged in for a few days, when they come back to my app, they get logged into the wrong account. I'm not entirely sure what the cause is, but it likely has something to do with the stored JWT. Maybe the JWT isn't unique so when the person come backs and the session is re-authenticated via the stored JWT, a different user is found? Any help on this is appreciated.

I'm using Rails as a headless API that handles the user accounts. The web app is a React app. The web app stores the JWT in the browser's localstorage.

Rails: 8.0.0
devise-jwt: 0.12.1
devise: 4.9.4

[waiting-for-dev]

I'm pretty sure that should be something related to your setup. This is how the user is fetched from a JWT token by default. As you can see the primary key is used to match the token, so maybe you should investigate along that lines.