yes. There are many that you need to consider. I suggest you have a look at our blog: https://supertokens.io/blog/all-you-need-to-know-about-user-session-security