Search code examples
sessionploneprivacy

How can I close all (plone) sessions opened by a user except the current one?


Let's suppose I'd opened two or more user sessions on two or more devices (same user with not admin privileges).

At the current session, if I log out, it means all others sessions will also close? If not, is there a way to do this by an URL request?

something like this:

  1. User call a method, ex: [plone-site]/close-all-sessions-except-this;
  2. Results on: all user sessions, opened on the others devices are closed.

Would be better if this method were native in plone.

gmail has this feature. I think it's an important security and privacy issue.


Solution

  • That's a nice feature request, would you mind opening an issue? AFAIK Plone doesn't include that by default.

    When you log out of one session Plone will close all sessions for that browser AND site URL, because the session is stored in a cookie set to site's domain. However Plone won't log you out from other browsers/devices, nor in the edge case you're accessing the site by IP, if that's available.