14
[Auth] Display user valid sessions and allow to invalidate some or all of them
Source: supabase/supabase#26863 · opened by @tomekit
Is there a way to display user active refresh tokens (e.g. with some associated information / device type) where user is able to display their valid sessions and invalidate some of them without affecting others?
By saying session I mean refresh token, not access token. I am aware of that access token can't be revoked, it will expire itself in a sensible time.
As a user think of a scenario when you're selling phone and restored device to factory settings, but forgot to "logout". In such case valid refresh token stays in the Supabase Auth, it would be good to be aware of it and invalidate it whilst preserving session on other devices.
It's not uncommon for other auth solutions to have an option to build a page for a user page with valid sessions, device type, last used and e.g. IP address.
I think it would be beneficial for Supabase to allow similar level of session granularity.
Related:
[Auth] Allow indefinite refresh token reuse
By saying session I mean refresh token, not access token. I am aware of that access token can't be revoked, it will expire itself in a sensible time.
As a user think of a scenario when you're selling phone and restored device to factory settings, but forgot to "logout". In such case valid refresh token stays in the Supabase Auth, it would be good to be aware of it and invalidate it whilst preserving session on other devices.
It's not uncommon for other auth solutions to have an option to build a page for a user page with valid sessions, device type, last used and e.g. IP address.
I think it would be beneficial for Supabase to allow similar level of session granularity.
Related:
[Auth] Allow indefinite refresh token reuse
No pledges yet. Be the first to back this.
Comments
Similar requests
SDK Support for Listing & Invalidating Auth Sessions
15 votes · 0 comments
Feature request for Supabase Auth: Automatically invalidate OTP after multiple failed login attempts
12 votes · 0 comments
Enforce any number sessions per user
3 votes · 0 comments
[Auth] Allow indefinite refresh token reuse
5 votes · 0 comments
Possibility to manage all active sessions
5 votes · 0 comments
No comments yet.