Search code examples
couchdbsession-managementcouchdb-futon

View active user sessions


Is it possible to view a list of active user sessions on a couchdb server?

There doesn't seem to be any mention of such a feature in the couch docs (http://docs.couchdb.org/en/2.0.0/api/server/authn.html#api-auth-session, http://docs.couchdb.org/en/2.0.0/api/index.html).

I also can see nothing similar to what I require in Futon nor Fauxton UIs.


Solution

  • Is it possible to view a list of active user sessions on a couchdb server?

    Short answer: No.

    Long answer: There's no such thing, really, as user sessions in CouchDB.

    CouchDB's "user session" cookies are just an HMAC of the user's password salt, the server secret, and the time the cookie was created (so it can tell when it expires).

    This means that an "active session" is any cookie that contains a valid HMAC composed from a valid user salt, the valid user cookie, and any timestamp that is less than N minutes in the past (where N is the expiration time).

    These sessions don't even have to be created on the CouchDB server, so even logging auth requests is not sufficient. It's a common practice in some situations to create these cookies in an app external to CouchDB.

    As a followup question:

    Why are you interested in listing active sessions? Maybe there's an alternative approach to accomplish whatever you're aiming for.