darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-23 15:57:23 -04:00
Code Issues Packages Projects Releases Wiki Activity

Ensure that the session is logged out server side, not just client side.

Browse Source 
Anytime a user clicks "sign out" we should be signing them out server side as well. This can be accomplished by setting the Users.current_session_id = null.
I found that the method User.logged_in_elsewhere doesn't need to check if the current_session_id is None. The current_session_ids in the cookie and db (redis or postgres) then the user should be forced to log in again.
This commit is contained in:
Rebecca Law
2020-01-31 15:50:55 +00:00
parent a49b492ade
commit 937c9f2adc
5 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/models/user.py
View File

@@ -127,8 +127,7 @@ class User(JSONModel, UserMixin):
)
def logged_in_elsewhere(self):
# if the current user (ie: db object) has no session, they've never logged in before
return self.current_session_id is not None and session.get('current_session_id') != self.current_session_id
return session.get('current_session_id') != self.current_session_id
def activate(self):
if self.state == 'pending':
@@ -154,6 +153,10 @@ class User(JSONModel, UserMixin):
return True
def sign_out(self):
# Update the db so the server also knows the user is logged out.
return self.update(current_session_id=None)
@property
def sms_auth(self):
return self.auth_type == 'sms_auth'