Meteor.accounts and loginTokens

[Jan Hendrik Mangold]

I am using the Accounts package that is being shipped with Meteor and everything works out of the box.

Of course I can't help myself to look at what is being stored on the server and I can see the db.users services.resume.loginTokens to grow. There does not seem to be any sort of garbage collection, like which tokens should be removed from mongodb? I have accounts with 16 or 30 loginTokens. 

Does anybody know if this is supposed to be?

Jan

[Warsame Bashir]

I asked the same question on SO

http://stackoverflow.com/questions/17457729/remove-login-tokens-for-meteor-auth

[Jan Hendrik Mangold]

I installed event-hooks from atmosphere and added the following hook on the server side (console.log gratuitous)

Hooks.onLoggedOut = function (userId) {
  var u = Meteor.users.findOne({_id: userId});
  if(u)
  {
    console.log('Logged out user '+userId+'. Number of login tokens: '+u.services.resume.loginTokens.length);
    Meteor.users.update({_id: userId},{$set:{"services.resume.loginTokens":[]}});
  }
};

Is this going to create a problem?

[Warsame Bashir]

This is an easier option. +1 i hope one of these meteor engineers can answer on this

On Sunday, July 7, 2013 2:45:51 PM UTC-5, Jan Hendrik Mangold wrote:

[Arunoda Susiripala]

Hi Jan,

AFAIK, this exists and have no official solution yet. 

Removing loginTokens at the lo

--
You received this message because you are subscribed to the Google Groups "meteor-talk" group.
To unsubscribe from this group and stop receiving emails from it, send an email to meteor-talk...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

--
Arunoda Susiripala

@arunoda

https://github.com/arunoda

http://www.linkedin.com/in/arunoda

[Arunoda Susiripala]

Hi Jan,

AFAIK, this exists and have no official solution yet. 

Removing loginTokens at the logout can have some bad effects since it will remove all the tokens. 

Some users may loggedin using several browser so have several tokens. Deleting all loginToken when loggedOut will loggedOut him from every browser. 

This may be a feature or a bug depending your app. 

Another way to deal with this is a use a cron job to remove older tokens. Each token contains a timestamp value. 

There is another way we can dealwith this. But complex. Using a loginHandler. 

Hope this helps you out. 

[Avital Oliver]

See https://github.com/meteor/meteor/pull/1039. You're right, we should resolve this.

[Jan Hendrik Mangold]

Arunoda

On Sunday, 7 July 2013 19:42:56 UTC-7, Arunoda Susiripala wrote:

Hi Jan,

AFAIK, this exists and have no official solution yet. 

Removing loginTokens at the logout can have some bad effects since it will remove all the tokens. 

Some users may loggedin using several browser so have several tokens. Deleting all loginToken when loggedOut will loggedOut him from every browser. 

that is what I thought as well. I would like to be more selective in removing tokens but couldn't even figure out what the active token of the session logging out was.

 

This may be a feature or a bug depending your app. 

Frankly, I would prefer if a user was just logged in once (on my app) because the device records the geo location in the user document ...

 

Another way to deal with this is a use a cron job to remove older tokens. Each token contains a timestamp value. 

There is another way we can dealwith this. But complex. Using a loginHandler. 

Hope this helps you out. 

I am just happy that I am not the only one facing this issue :) 

[Jan Hendrik Mangold]

I have removed the deletion of all services.resume.loginTokens on logout because it might create undesired side effects. What would be nice instead is to at least remove the "current" loginToken that is being logged out. How do I find the current loginToken?

[Nick Martin]

Hi Jan,

Deleting the current login token when logging out was just added in git, and will be in the next release =)

https://github.com/meteor/meteor/commit/1a40e238d223cdd5ec64b53ab5bf9770b18900f2

-- Nick

--

[Arunoda Susiripala]

Thanks Nick.

This is nice and a clean way.

[steeve]

What may be interesting is for users to be able to reset login tokens across all devices/sessions similar to how Google Apps works.  Which of course would open up the methods to handle it server side and/or from an admin panel one might build.

The infrastructure is already there within Meteor to support this. 

The remove on logout is nice.  

[Ken Yee]

On Thursday, July 11, 2013 10:00:31 AM UTC-4, steeve wrote:

What may be interesting is for users to be able to reset login tokens across all devices/sessions similar to how Google Apps works.  Which of course would open up the methods to handle it server side and/or from an admin panel one might build.

AFAIK, this won't log them out though.  It'll just prevent them from being able to log in again on the next session when they restart their browser?