diff --git a/easytier-web/src/client_manager/mod.rs b/easytier-web/src/client_manager/mod.rs
index a08e95ac..c0b59337 100644
--- a/easytier-web/src/client_manager/mod.rs
+++ b/easytier-web/src/client_manager/mod.rs
@@ -161,6 +161,10 @@ impl ClientManager {
         self.storage.list_clients()
     }
 
+    pub async fn list_sessions_by_user_id(&self, user_id: UserIdInDb) -> Vec<StorageToken> {
+        self.storage.list_user_client_tokens(user_id)
+    }
+
     pub async fn list_all_sessions(&self) -> Vec<StorageToken> {
         self.storage.list_all_clients()
     }
diff --git a/easytier-web/src/client_manager/storage.rs b/easytier-web/src/client_manager/storage.rs
index 297d8666..8d195bb4 100644
--- a/easytier-web/src/client_manager/storage.rs
+++ b/easytier-web/src/client_manager/storage.rs
@@ -143,6 +143,21 @@ impl Storage {
         self.list_clients_with_auth(true)
     }
 
+    /// List authorized client sessions that belong to a single user only.
+    pub fn list_user_client_tokens(&self, user_id: UserIdInDb) -> Vec<StorageToken> {
+        self.0
+            .user_clients_map
+            .get(&user_id)
+            .map(|info_map| {
+                info_map
+                    .iter()
+                    .filter(|info| info.value().authorized)
+                    .map(|info| info.value().storage_token.clone())
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+
     pub fn list_all_clients(&self) -> Vec<StorageToken> {
         self.list_clients_with_auth(false)
     }
diff --git a/easytier-web/src/restful/mod.rs b/easytier-web/src/restful/mod.rs
index f759e067..cf449d9b 100644
--- a/easytier-web/src/restful/mod.rs
+++ b/easytier-web/src/restful/mod.rs
@@ -14,7 +14,7 @@ use axum::response::Response;
 use axum::routing::{delete, post};
 use axum::{Extension, Json, Router, extract::State, routing::get};
 use axum_login::tower_sessions::{ExpiredDeletion, SessionManagerLayer};
-use axum_login::{AuthManagerLayerBuilder, AuthUser, AuthzBackend, login_required};
+use axum_login::{AuthManagerLayerBuilder, AuthUser, login_required};
 use axum_messages::MessagesManagerLayer;
 use easytier::common::config::{ConfigLoader, TomlConfigLoader};
 use easytier::launcher::NetworkConfig;
@@ -131,13 +131,10 @@ impl RestfulServer {
         auth_session: AuthSession,
         State(client_mgr): AppState,
     ) -> Result<Json<ListSessionJsonResp>, HttpHandleError> {
-        let perms = auth_session
-            .backend
-            .get_group_permissions(auth_session.user.as_ref().unwrap())
-            .await
-            .unwrap();
-        println!("{:?}", perms);
-        let ret = client_mgr.list_sessions().await;
+        let Some(user) = auth_session.user else {
+            return Err((StatusCode::UNAUTHORIZED, other_error("No such user").into()));
+        };
+        let ret = client_mgr.list_sessions_by_user_id(user.id()).await;
         Ok(ListSessionJsonResp(ret).into())
     }