Skip to content

GitLab

  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • O OLKi
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 18
    • Issues 18
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 0
    • Merge requests 0
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • SyNaLP
  • OLKi
  • OLKi
  • Issues
  • #7
Closed
Open
Created Apr 02, 2019 by Rigel Kent@rigelk☕Owner

User session management and token expiry

Right now the user gets a token for each login, and the token is not expired. While we can just keep track of the last token and expire all others, that would prevent usage of multiple devices. Keeping a list of sessions/machines (via their User-Agent?) and only allowing the last token for them would be the best option.

See https://github.com/GetBlimp/django-rest-framework-jwt/issues/291

Django-rest-knox library provides models and views to handle token based authentication in a more secure and extensible way than the built-in TokenAuthentication scheme - with Single Page Applications and Mobile clients in mind. It provides per-client tokens, and views to generate them when provided some other authentication (usually basic authentication), to delete the token (providing a server enforced logout) and to delete all tokens (logs out all clients that a user is logged into).

See https://github.com/sunscrapers/djoser/issues/362

Edited Apr 02, 2019 by Rigel Kent
Assignee
Assign to
Time tracking