mardi 15 mai 2018

How to track sessions & invalidate them on demand in Laravel 5.1

It started with invalidating all other sessions except current one when a user changes the password, so with this, I came with a thought, if I am doing this then why shouldn't the user be provided a facility/feature where a user can check a list of his active sessions and invalidate any of them whenever he/she wishes, thus a feature to track the user sessions...

Example: There are three sessions of the user, 1. Windows-Chrome, 2. Android-Chrome, 3. Mac-Safari. Now say user is currently logged in from 2nd one (Android-Chrome) and wishes to invalidate his 3rd session (Mac-Safari), then he should be able to do it. This feature, is what I am tring to achieve.

I'm working with Laravel 5.1 & file-driver based Sessions.

What I've done/tried:

  1. I created a separate sessions table for user (user_sessions) with following properties:

    id (PK), user_id(FK users table), session_id(varchar), ...userAgentProps fields..., created_at, updated_at

  2. Then overrode authenticated() & logout() methods within AuthController, to manage session records within user_sessions table. Whenever a user is authenticated, its session_id is recorded within the table, Whenever a user logs out, that session's record is removed from user_sessions table.

  3. Using user_sessions table, I can show a user the list of his active sessions. Now with this list, I'm providing a button saying invalidate this session which when clicked, would invalidate that particular session.

The Problem: Everything depicted above works just perfectly fine! but with a catch: User should not use remember me feature, Why?: Without remember me cookie, this works perfectly well, but with remember me cookie, browser re-logins the user, so deleting/invalidating the older session becomes of no use, as a fresh new session for the user is created using that remember me cookie within the browser.

The Question: How do I achieve this whole feature along with remember me cookie?



via Chebli Mohamed

Aucun commentaire:

Enregistrer un commentaire