Same access token between different fetch_token requests

Question

TL;DR:

Is it (or would it be) possible to get the same access_token from one fetch_token request to another, provided that the user is the same?

Scenario:

1. An anonymous user authenticates with Stack Exchange on my website
2. He does some stuff which I save in my db (for instance he says he likes blue)
3. The day after, he visits my website again with another browser/computer
4. He tries to authenticate with his Stack Exchange account again
5. Obviously, I want to make sure that he logs on my site with the account he created in 1.

The problem:

Currently, the access_token given in 4. will be different than the one given in 1. which has the following downsides:

• Each time someone logs in my website with his Stack Exchange account, I can't simply use the access_token to check if the user already exists in my db. I have to make one more request to get his account_id and check with that
• Which in turn, also forces me to store Stack Exchange's account_id in my db

Answer 1

Yes, each time you invoke stackexchange.com/oauth/ you will get a fresh access token, even though old ones may still be valid.
For example:

1. Go to /me/inbox^Livedoc and hit Get Token twice, recording the token value each time (It will always be different).
2. Then go to /access-tokens/{accessTokens}^Livedoc and check each token. They will both still be valid! (Valid tokens return an entry in the items array. Invalid or expired tokens return nothing.)

At the very least, one would expect that issuing a new token for the same app+permissions+user should invalidate old tokens for that app+permissions+user. Littering the bitbucket with lots of unused, but valid, tokens just makes it easier for bad guys. ;)

Returning the last-issued token, if it is still valid, would be convenient but there might be some reason not to.

You can submit a feature-request to improve these behaviors but, unless a definite vulnerability is shown, it may be a while before anything changes. (API development seems to have stalled.)

---

Workaround-ish:

If you know who the user is by some other means (cookie, localStorage, etc.), and you stored her last valid access_token, you can use /access-tokens/{accessTokens} to see if that token is still valid.
If it is, just use that token and skip the fresh call to stackexchange.com/oauth/.

You need a way to track a user outside of access_token, but you should be doing that anyway.
Tokens are meant to be ephemeral and identification and authorization should be kept separate.

Also, protect yourself and the user and /access-tokens/{accessTokens}/invalidate tokens when you are done with them or if you are calling stackexchange.com/oauth/ for a fresh token.