0

I could login through the website, android app, iOS app, the browsers on mobile, and when I log out from one, it doesn't log me out of all of them. Traditionally, you would log out of all the services at once because your auth_token would be set to null in the DB. That being said, I don't see a way to do this through Rails and Devise.

I only have two solutions so far.

The first one is to have separate session tokens, and figure out which to use based on a header. However, if you want unlimited number of sessions, you need some unique ID to follow through on. I'm not sure how you'd achieve this.

The second solution is to have a counter in the DB named sessions. It keeps track of how many sessions you currently have logged in. If I'm logged in through the website, Android app and iOS app, it would be 3. Whenever you have more than 1 session open and log-out, the number of sessions would be decremented. If the number of sessions becomes 0, we set the auth_token to null in the DB (nil in Ruby).

The only loop-hole I could see in this is that if someone logs out, is still logged in on some other platform, and is code savvy, they could find the auth_token via previous requests on their browser. Then, they could send it in and continue to use it even though they have technically logged out. I don't necessarily see a problem with this, but I don't know if this is a good way to do it.

Does anyone else have a good suggestion? Is there a better place to post this?

Improve this question
1
  • 4
    Are you considering "traditionally" to be "whatever Rails does by default"?
    – Greg Hewgill
    Sep 1, 2014 at 21:15

2 Answers 2

Reset to default
4

One way to implement this would be to keep a separate authentication token for each browser session, instead of one shared authentication token. You can store that in a browser cookie, which is of course specific to that browser, and selecting the "log out" option would clear that browser cookie (and remove it from the database). Even if somebody were to find an auth_token from previous requests for a specific browser, it wouldn't work after that session has been removed from the server database.

So, short answer, use one authentication token per browser instead of one per user account. How you implement that in your server-side web framework is up to you.

Improve this answer
1
  • I suppose on the server side, I could keep a Redis hash that maps an auth_token to a user_id. If the user_id is not found, handle that. If found, continue with that as the current_user.
    – David
    Sep 2, 2014 at 5:19
1

Each time you login from a device you create a unique session presumably with a unique authentication cookie. This session/authorization is for that device only, but, usually you are allowed other logins and sessions from other devices in parrallel.

I don't no why you think this is not the "normal" behavior as its how Google, Stackoverflow and may other sites handle logins and authentications.

This means I can keep my smartphone logged in to google unaffected by signing on and signing of on my PC.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.