my problem is with laravel auth::logout functionality,
Imagine a user is jept logged in, in different browsers and when I call Auth::logout in one of the browser, it logges out from the other browsers out too,
Is there anyway tosolve this problem in laravel itself?
Edit: this is real problem, when a user is kept logged in in his pc and logs out from another computer, which causes to be logged out from his own pc too.
This functionality was a specific feature added to Laravel 4.1.26 as a security measure.
The reason is the exact scenario you provide - if you leave yourself logged in on Computer A, and log yourself out of Computer B - this ensures you are fully logged out of all computers.
It is a security measure. Before this update, if a remember cookie was hijacked by another malicious user, the cookie would remain valid for a long period of time, even after the true owner of the account reset their password, logged out, etc
Related
good morning. I have several domains and subdomains with Laravel. One of the subdomains does the login, logout and verification tasks.
My question is, how can I log in to the rest of the subdomain that I log in?
The bigger problem I have is that it does not log in to the site but it runs online?
And that I send a request, it is sent, but the answer does not come for Ajax to show, but it comes in the network
thanks.
Perhaps you could make a database table that checks the user logins that will also expire. So when a user enters your sub domains it checks via ip(not recommended) or other things if that user is logged in.
I've developed an app in laravel and sentry2 as ACL. Login occurs through SAML.
Whenever a user logs in from SAML is redirected to my app where I check server variables, and if credentials are correct I let him pass to the site with sentry.
My issue occurs when I try to log in with the same account in two different browsers. Looks like when I log in in the second browser the existing session in the other browser gets overrided.
I've found out this looking into sessions table:
http://pastebin.com/6iEnRkEs
Any ideas? Will appreciate your help on this very much.
Thanks a lot!
Pablo
EDIT:
The idea would be that the app work like gmail/fb that allows the user to be logged in both browsers at the same time.
It's correct the way it is.
Different browsers different sessions. This is a security feature/matter every single app should enforce.
If you log in a different browser how could Laravel tell if it's not a different person login in from a different computer in the same network? Log someone off in this case it's also the correct thing to do, because if some kind of exploit is happening, user will see something is wrong and, maybe, change his/her password.
Some (ie: banking) also do: different browser tabs, different sessions, but this is not the Laravel case.
I am using Spring Security 3.0.2 on a web site where users can log into their account. The account landing page has a button that takes you to a second page. Various users report that they have trouble getting to that second page because they are asked to log in again and again when they press the button. I cannot reproduce the problem myself, and it seems to work for most people. However, enough people have complained about the issue that I take them seriously. What could be the cause for such a spurious malfunction?
I see some possible cases maybe some of them would produce a 403 and not a redirect :
the second page is protected by a intercept-url with a list of role and some user doesn't have the required role. Maybe your account has some "admin" role which allow you to access any page that why you can not reproduce it
same problem but whith method #Secured with role that some users doesn't have
maybe these user aren't accepting cookie
maybe you have multiple domain the cookie is created for the domain www.domain.com then the user is redirected to another domain like www1.domain.com where the cookie doesn't apply.
maybe you have some kind of miss configuration in the load balancing the session is created on the 1st server, then the 2nd page is handled by the 2nd server where the session doesn't exists
maybe somewhere in the code you call session.invalidate()
hope it helps
I'm developing my web app with Spring MVC 2.5.6 and I need some help for multiple user sessions in it. The header of my app shows the logged user.
In my computer, I open two browsers (no tabs):
In the first one, I log in my app with user1 and get into. In the header, user1 appears.
In the second, I log in with user2 and go on. In the header, user2 appears.
Then, I switch to the first browser, submit an operation to the controller and when the app is showed again, in the header user2 appears, and it's wrong because I logged in with user1.
So, my questions are:
SecurityContextHolder.getContext().getAuthentication().getName() may not be the right way to get the logged user with many users, because it's singleton (isn't it?). How could I do this?
This wrong situation is also happening with session object, so user1 data stored in the session object (managed with request.getSession().setAttribute(...) and request.getSession.getAttribute(...)) is override with user2 data.
In this StackOverflow question, Handling Session ID with Spring, it's suggested that session ID would be managed to separate data. Should I manage manually each user data with session ID internally in my application? How could I get the session ID?
In general terms, my problem is with dealing with multiple users/sessions.
Any help would be very appreciated. Thanks in advance.
Best regards
In my computer, I open two browsers (no tabs):
In the first one, I log in my app with user1 and get into. In the header, user1 appears.
In the second, I log in with user2 and go on. In the header, user2 appears.
Then, I switch to the first browser, submit an operation to the controller and when the app is showed again, in the header user2 appears, and it's wrong because I logged in with user1.
With session as normally implemented, this is normal behavior if the client is running two windows or tabs of the same browser on the same machine, as they share the session.
If you open the app in IE and Firefox, they will not share a session, and things will work properly.
I don't believe there's a way to get the browser to stop sharing session among windows, so if you need them to act independently, you'll need to essentially create your own session mechanism, likely by using hidden fields or some such hack rather than the cookies or url-rewriting the normal mechanism uses.
It would be better to just accept the situation. Let the user know when they open the second window and connect to your app that they are already logged in, and don't allow another login.
I am writing my first FireFox extension and I have some questions. Maybe someone can help.
I have a website which requires login. The sign-in is one user per login type. So if I am logged with the username "tom" from one PC and go to other PC and try to login with the same details, it fails. When I click the log-out button from my authenticated page, the new location executes a PHP function to log-out the user (updates the "logged" status of the user in MySQL). The problem is that if a user is logged in from his work desk and surfing the page then suddenly he gets a call by a friend to quickly grab lunch in his break and has to meet him in short time, he just clicks the X (close) button from Firefox, forgetting to press the log-out button so the status of the logged is still 1. Later on, if he wants to access the page again from home, he won't be able to log in.
So, I need to grab the "close" event from firefox somehow. I am thinking about looking for the ones that contain the "website.com" domain only. Then, if a tab is closed or the main window of Firefox is closed, send an unique key, and the username to that URL that logs out the user and the problem may be solved. I don't know if this is possible. Please post any idea (followed by code if you can) for this extension to be built.
Thank you.
By design, this is wrong.
If a user's PC crashes (harddisk failure, power failure) your plugin won't be able to log out the user. And so, the user won't be able to login on any PC.
--
Let's revisit the premise,
a. why does logging in from another PC need to fail?
b. How about invalidating the login from the previous PC (log out) when the user logs in to another PC. THis is kind of like how chat applications like Yahoo! Messenger work.
From your answers, here's what i would suggest: if the user is logged in on another PC, warn and present the user with options:
cancel logging in
forcibly log out the other user and proceed to logging in
Logging the user out after a certain time of inactivity is the (application or web) server's responsibility, not (only) the client-browser's. This is called a session timeout.
You might be able to avoid the timeout by a browser implementation as you describe it, but this should not be the primary solution.
Here's an off hand approach you might take:
In your case I would include a timestamp in the table where the 'locked' state is stored. Every time a user does an action that timestamp is updated. When you try to login again ad the timestamp is older that a certain threshold (e.g. 15min) your login code should silently logout the previous user.
In order to receive a notice about the tab being closed, you'll want to do something like this sample code. However, instead of listening for load, you'll want to listen for unload.
When you do end up getting notified about unload, you'll have to do a request to the logout page just like the web application does. You can figure out what the location of the document that is unloading is by checking aEvent.originalTarget.location.href. Note that aEvent.originalTarget will give you the document object of the tab that is closing. You'll then want to use an XLMHttpRequest for this in your event handler.
You could use ajax that would ping a page on the site - all the session info will be passed and you can verify that the user still has an active browser/page open. If Firefox crashes it won't be able to ping the website anymore and the session could time-out after 15 minutes. I think that allowing a forced logout on another sign-in would be best. Usually when I leave work at the end of the day I wouldn't close all the programs or logout or anything - just lock my computer to prevent anyone from using it. Next morning I come back with all my programs still running so I can continue where I left off.
BTW, Yahoo Web messenger probably uses some form of session-based cookies. That is, cookies are stored in memory and are gone when the tab or browser are closed.
Just enable to the user to re-login from another machine. And if you get a request from the user on first machine, ask him to re-login too. So you get a single logged in user at a time.