google app engine - Webapp2 List (and/or kill) All Sessions for User (Appengine Python) -
i'm working on appengine app using webapp2. based authentication off of ideas put forward in this article.
i added ability delete account (it's requirement of app), , i've run issue sessions. if user logged in more 1 location, there 2 auth tokens user. when account deleted 1 of logins, session login destroyed. however, other login have auth token in datastore.
i altered user_required
/check_login
decorator/function first looks user in session. if doesn't find one, let client know need login in. if find one, user datastore. if none, assume there multiple logins, , different 1 deleted account (which deletes user). therefore, kill session, , tell client user no longer exists. otherwise, check if user verified, , if isn't tell client user has verified before anything.
i'd rather able kill sessions user if account deleted. there way this? want functionality can have feature logged in user can see of sessions user, , kill/revoke them @ (sort of facebook , google, , i'm sure plenty of other services) offer.
edit: though i'd end getting user datastore @ point anyways, , when call self.user
webapp2.cached_property
, still rather not have user @ beginning of every request decorated user_required
if can maybe away pulling info session.
sounds you're using datastore backend sessions.
the best way modify session framework session entity stores user id. way can query session entities user id, delete them , flush them out of memcache.
alternatively can store sessions in user entity, , when delete user, go through list , rid of sessions. might bit of pain clean out expiring sessions user entity though.
Comments
Post a Comment