Ensure that the session is logged out server side, not just client side.

Anytime a user clicks "sign out" we should be signing them out server side as well. This can be accomplished by setting the Users.current_session_id = null.
I found that the method User.logged_in_elsewhere doesn't need to check if the current_session_id is None. The current_session_ids in the cookie and db (redis or postgres) then the user should be forced to log in again.

app/main/views/sign_out.py

@@ -1,11 +1,12 @@
 from flask import redirect, session, url_for
-from flask_login import logout_user
+from flask_login import current_user, logout_user
 
 from app.main import main
 
 
 @main.route('/sign-out', methods=(['GET']))
 def sign_out():
+    current_user.sign_out()
     session.clear()
     logout_user()
     return redirect(url_for('main.index'))

app/models/user.py

@@ -127,8 +127,7 @@ class User(JSONModel, UserMixin):
         )
 
     def logged_in_elsewhere(self):
-        # if the current user (ie: db object) has no session, they've never logged in before
-        return self.current_session_id is not None and session.get('current_session_id') != self.current_session_id
+        return session.get('current_session_id') != self.current_session_id
 
     def activate(self):
         if self.state == 'pending':
@@ -154,6 +153,10 @@ class User(JSONModel, UserMixin):
 
         return True
 
+    def sign_out(self):
+        # Update the db so the server also knows the user is logged out.
+        return self.update(current_session_id=None)
+
     @property
     def sms_auth(self):
         return self.auth_type == 'sms_auth'

app/notify_client/user_api_client.py

@@ -10,7 +10,8 @@ ALLOWED_ATTRIBUTES = {
     'email_address',
     'mobile_number',
     'auth_type',
-    'updated_by'
+    'updated_by',
+    'current_session_id'
 }