3 grammar
source | link

How should an API or server should respond, if when a device reportsconnects with a different account than it is bindbound to?

Let's say, thatIn my system we have users (users accounts on server) and user devices, used by users. Rules:

  1. EachA user can have only one user account on server.
  2. Each user can have many devices.
  3. Each devices is always bindA device can be bound to only one user account.

Upon initial installation, when adding new device, or after a "master reset", the user must provide the login and password to his/her account, that will to bind this particular device to thatthe account. After that each, the device with each request sends ita unique token with each request and is recognized by that token.

SituationSo the normal situation is like that. Device A is bindbound to User A and operates normallytime goes on. Then, for some reasonThis question pertains to the situation later on, itwhen a request from Device A is reset, user enters login and password and it turns out, that thesemade using the credentials belongs tofor User B (account B) on server.

What should happen in this situation? How should the API / server respond, when it detect,detects that anya device already bindbound to someone user account is trying to rebind itself to another account?

Let's use Dropbox as an example. What would happen, when someone would uninstalluninstalls the Dropbox client on one of itstheir computers, previously used with account A, then reinstallreinstalls it, but provided with credentials tofor account B? We would have situation, whereThe local client would be pointing to a DropboxDropbox folder containing some files, but wishingtrying to sync it with an account that havehas a completely different set of files. Note, that I haven't tested such a situation,. I'm not willing to and I'm not interested in learning, how Dropbox handles this.this; I'm only givingusing this as an example to question on how should I designhelp describe my system to act in such situation.

What I have come up with so far:

  1. Treat this as a normal situation. Automatically and automatically rebind the device to a newthe account as requested. But wouldn't this make a lot of mess in the database in terms of what user seesees or havehas access to (stats, data, history etc.)?

  2. Treat this as an error situation. Assume that to rebind a device to another account, it must be first unbindbe unbound from its previous account. If user can't access their "old" (previous) account due to password lost password etc., he/she should use the password reset form or contact support.

  3. Something different. Not mentioned above.

After doing some thinking and a little bit research I'm pretty convinced tothat option two. But is the best solution for me, but I'd like to know, if I'm not on the first step to some kind of death-path or sth anyone foresees any major problems with this approach. Is there any reason, I shouldn't follow option 2?

Edit: I'm talking aboutThis system deals with non-computer devices.devices; Dropbox is just an example here. I'm talking aboutIn my scenario, where 95% of devices isare always used by one and the same user and are not shared among others. And described situation could (perMy assumption) is that this situation can only occursoccur as an result of error or intentional, but non-standardunsupported actions (hacking, checking what will happen, if, etc.).

How API or server should respond, if device reports different account than it is bind to?

Let's say, that we have users (users accounts on server) and devices, used by users. Rules:

  1. Each user can have only one account on server.
  2. Each user can have many devices.
  3. Each devices is always bind one user account.

Upon initial installation, when adding new device or after "master reset" user must provide login and password to his/her account, that will bind this particular device to that account. After that each device with each request sends it unique token and is recognized by that token.

Situation is like that. Device A is bind to User A and operates normally. Then, for some reason, it is reset, user enters login and password and it turns out, that these credentials belongs to User B (account B) on server.

What should happen in this situation? How should API / server respond, when it detect, that any device already bind to some user account is trying to rebind itself to another account?

Let's use Dropbox example. What would happen, when someone would uninstall Dropbox client on one of its computers, previously used with account A, then reinstall it, but provided credentials to account B? We would have situation, where local client would be pointing to a Dropbox folder containing some files, but wishing to sync it with an account that have completely different set of files. Note, that I haven't tested such situation, I'm not willing to and I'm not interested in learning, how Dropbox handles this. I'm only giving this as an example to question on how should I design my system to act in such situation.

What I have come with so far:

  1. Treat this as a normal situation. Automatically rebind device to a new account. But wouldn't this make a lot of mess in database in terms of what user see or have access to (stats, data, history etc.)?

  2. Treat this as an error situation. Assume that to rebind a device to another account it must be first unbind from its previous account. If user can't access "old" (previous) account due to password lost etc., he/she should use password reset form or contact support.

  3. Something different. Not mentioned above.

After doing some thinking and a little bit research I'm pretty convinced to option two. But, I'd like to know, if I'm not on the first step to some kind of death-path or sth. Is there any reason, I shouldn't follow option 2?

Edit: I'm talking about non-computer devices. Dropbox is just an example here. I'm talking about scenario, where 95% of devices is always used by one and the same user and are not shared among others. And described situation could (per assumption) only occurs as an result of error or intentional, but non-standard actions (hacking, checking what will happen, if, etc.).

How should an API or server respond when a device connects with a different account than it is bound to?

In my system we have users accounts and user devices. Rules:

  1. A user can have only one user account.
  2. Each user can have many devices.
  3. A device can be bound to only one user account.

Upon initial installation, when adding new device, or after a "master reset", the user must provide the login and password to his/her account to bind this particular device to the account. After that, the device sends a unique token with each request and is recognized by that token.

So the normal situation is that Device A is bound to User A and time goes on. This question pertains to the situation later on, when a request from Device A is made using the credentials for User B.

What should happen in this situation? How should the API / server respond when it detects that a device already bound to one user account is trying to rebind itself to another account?

Let's use Dropbox as an example. What would happen when someone uninstalls the Dropbox client on one of their computers previously used with account A, then reinstalls it with credentials for account B? The local client would be pointing to a Dropbox folder containing some files but trying to sync it with an account that has a completely different set of files. Note that I haven't tested such a situation. I'm not willing to and I'm not interested in learning how Dropbox handles this; I'm only using this as an example to help describe my situation.

What I have come up with so far:

  1. Treat this as a normal situation and automatically rebind the device to the account as requested. But wouldn't this make a mess in the database in terms of what user sees or has access to (stats, data, history etc.)?

  2. Treat this as an error situation. Assume that to rebind a device to another account, it must first be unbound from its previous account. If user can't access their "old" (previous) account due to lost password etc., he/she should use the password reset form or contact support.

  3. Something different. Not mentioned above.

After doing some thinking and a little research I'm pretty convinced that option two is the best solution for me, but I'd like to know anyone foresees any major problems with this approach. Is there any reason I shouldn't follow option 2?

Edit: This system deals with non-computer devices; Dropbox is just an example. In my scenario 95% of devices are always used by the same user and are not shared among others. My assumption is that this situation can only occur as an result of error or intentional, but unsupported actions (hacking, checking what will happen if, etc.).

2 added 380 characters in body
source | link

Let's say, that we have users (users accounts on server) and devices, used by users. Rules:

  1. Each user can have only one account on server.
  2. Each user can have many devices.
  3. Each devices is always bind one user account.

Upon initial installation, when adding new device or after "master reset" user must provide login and password to his/her account, that will bind this particular device to that account. After that each device with each request sends it unique token and is recognized by that token.

Situation is like that. Device A is bind to User A and operates normally. Then, for some reason, it is reset, user enters login and password and it turns out, that these credentials belongs to User B (account B) on server.

What should happen in this situation? How should API / server respond, when it detect, that any device already bind to some user account is trying to rebind itself to another account?

Let's use Dropbox example. What would happen, when someone would uninstall Dropbox client on one of its computers, previously used with account A, then reinstall it, but provided credentials to account B? We would have situation, where local client would be pointing to a Dropbox folder containing some files, but wishing to sync it with an account that have completely different set of files. Note, that I haven't tested such situation, I'm not willing to and I'm not interested in learning, how Dropbox handles this. I'm only giving this as an example to question on how should I design my system to act in such situation.

What I have come with so far:

  1. Treat this as a normal situation. Automatically rebind device to a new account. But wouldn't this make a lot of mess in database in terms of what user see or have access to (stats, data, history etc.)?

  2. Treat this as an error situation. Assume that to rebind a device to another account it must be first unbind from its previous account. If user can't access "old" (previous) account due to password lost etc., he/she should use password reset form or contact support.

  3. Something different. Not mentioned above.

After doing some thinking and a little bit research I'm pretty convinced to option two. But, I'd like to know, if I'm not on the first step to some kind of death-path or sth. Is there any reason, I shouldn't follow option 2?

Edit: I'm talking about non-computer devices. Dropbox is just an example here. I'm talking about scenario, where 95% of devices is always used by one and the same user and are not shared among others. And described situation could (per assumption) only occurs as an result of error or intentional, but non-standard actions (hacking, checking what will happen, if, etc.).

Let's say, that we have users (users accounts on server) and devices, used by users. Rules:

  1. Each user can have only one account on server.
  2. Each user can have many devices.
  3. Each devices is always bind one user account.

Upon initial installation, when adding new device or after "master reset" user must provide login and password to his/her account, that will bind this particular device to that account. After that each device with each request sends it unique token and is recognized by that token.

Situation is like that. Device A is bind to User A and operates normally. Then, for some reason, it is reset, user enters login and password and it turns out, that these credentials belongs to User B (account B) on server.

What should happen in this situation? How should API / server respond, when it detect, that any device already bind to some user account is trying to rebind itself to another account?

Let's use Dropbox example. What would happen, when someone would uninstall Dropbox client on one of its computers, previously used with account A, then reinstall it, but provided credentials to account B? We would have situation, where local client would be pointing to a Dropbox folder containing some files, but wishing to sync it with an account that have completely different set of files. Note, that I haven't tested such situation, I'm not willing to and I'm not interested in learning, how Dropbox handles this. I'm only giving this as an example to question on how should I design my system to act in such situation.

What I have come with so far:

  1. Treat this as a normal situation. Automatically rebind device to a new account. But wouldn't this make a lot of mess in database in terms of what user see or have access to (stats, data, history etc.)?

  2. Treat this as an error situation. Assume that to rebind a device to another account it must be first unbind from its previous account. If user can't access "old" (previous) account due to password lost etc., he/she should use password reset form or contact support.

  3. Something different. Not mentioned above.

After doing some thinking and a little bit research I'm pretty convinced to option two. But, I'd like to know, if I'm not on the first step to some kind of death-path or sth. Is there any reason, I shouldn't follow option 2?

Let's say, that we have users (users accounts on server) and devices, used by users. Rules:

  1. Each user can have only one account on server.
  2. Each user can have many devices.
  3. Each devices is always bind one user account.

Upon initial installation, when adding new device or after "master reset" user must provide login and password to his/her account, that will bind this particular device to that account. After that each device with each request sends it unique token and is recognized by that token.

Situation is like that. Device A is bind to User A and operates normally. Then, for some reason, it is reset, user enters login and password and it turns out, that these credentials belongs to User B (account B) on server.

What should happen in this situation? How should API / server respond, when it detect, that any device already bind to some user account is trying to rebind itself to another account?

Let's use Dropbox example. What would happen, when someone would uninstall Dropbox client on one of its computers, previously used with account A, then reinstall it, but provided credentials to account B? We would have situation, where local client would be pointing to a Dropbox folder containing some files, but wishing to sync it with an account that have completely different set of files. Note, that I haven't tested such situation, I'm not willing to and I'm not interested in learning, how Dropbox handles this. I'm only giving this as an example to question on how should I design my system to act in such situation.

What I have come with so far:

  1. Treat this as a normal situation. Automatically rebind device to a new account. But wouldn't this make a lot of mess in database in terms of what user see or have access to (stats, data, history etc.)?

  2. Treat this as an error situation. Assume that to rebind a device to another account it must be first unbind from its previous account. If user can't access "old" (previous) account due to password lost etc., he/she should use password reset form or contact support.

  3. Something different. Not mentioned above.

After doing some thinking and a little bit research I'm pretty convinced to option two. But, I'd like to know, if I'm not on the first step to some kind of death-path or sth. Is there any reason, I shouldn't follow option 2?

Edit: I'm talking about non-computer devices. Dropbox is just an example here. I'm talking about scenario, where 95% of devices is always used by one and the same user and are not shared among others. And described situation could (per assumption) only occurs as an result of error or intentional, but non-standard actions (hacking, checking what will happen, if, etc.).

1
source | link

How API or server should respond, if device reports different account than it is bind to?

Let's say, that we have users (users accounts on server) and devices, used by users. Rules:

  1. Each user can have only one account on server.
  2. Each user can have many devices.
  3. Each devices is always bind one user account.

Upon initial installation, when adding new device or after "master reset" user must provide login and password to his/her account, that will bind this particular device to that account. After that each device with each request sends it unique token and is recognized by that token.

Situation is like that. Device A is bind to User A and operates normally. Then, for some reason, it is reset, user enters login and password and it turns out, that these credentials belongs to User B (account B) on server.

What should happen in this situation? How should API / server respond, when it detect, that any device already bind to some user account is trying to rebind itself to another account?

Let's use Dropbox example. What would happen, when someone would uninstall Dropbox client on one of its computers, previously used with account A, then reinstall it, but provided credentials to account B? We would have situation, where local client would be pointing to a Dropbox folder containing some files, but wishing to sync it with an account that have completely different set of files. Note, that I haven't tested such situation, I'm not willing to and I'm not interested in learning, how Dropbox handles this. I'm only giving this as an example to question on how should I design my system to act in such situation.

What I have come with so far:

  1. Treat this as a normal situation. Automatically rebind device to a new account. But wouldn't this make a lot of mess in database in terms of what user see or have access to (stats, data, history etc.)?

  2. Treat this as an error situation. Assume that to rebind a device to another account it must be first unbind from its previous account. If user can't access "old" (previous) account due to password lost etc., he/she should use password reset form or contact support.

  3. Something different. Not mentioned above.

After doing some thinking and a little bit research I'm pretty convinced to option two. But, I'd like to know, if I'm not on the first step to some kind of death-path or sth. Is there any reason, I shouldn't follow option 2?