FeatureFuel
14

[Auth] Display user valid sessions and allow to invalidate some or all of them

Source: supabase/supabase#26863 · opened by @tomekit
Is there a way to display user active refresh tokens (e.g. with some associated information / device type) where user is able to display their valid sessions and invalidate some of them without affecting others?

By saying session I mean refresh token, not access token. I am aware of that access token can't be revoked, it will expire itself in a sensible time.

As a user think of a scenario when you're selling phone and restored device to factory settings, but forgot to "logout". In such case valid refresh token stays in the Supabase Auth, it would be good to be aware of it and invalidate it whilst preserving session on other devices.

It's not uncommon for other auth solutions to have an option to build a page for a user page with valid sessions, device type, last used and e.g. IP address.

I think it would be beneficial for Supabase to allow similar level of session granularity.

Related:
[Auth] Allow indefinite refresh token reuse

No pledges yet. Be the first to back this.

Make a pledge

Pledge your monetary support if this feature is added.

$

Comments

No comments yet.

Replying to

Add a comment

What do you think about this feature request?


Similar requests