[GitHub] [couchdb] rnewson commented on issue #844: Add new explicit authentication-tokens that can be revoked

[GitBox <gi...@apache.org>]

rnewson commented on issue #844: Add new explicit authentication-tokens that can be revoked
URL: https://github.com/apache/couchdb/issues/844#issuecomment-477811388
 
 
   The simplest way to implement a /_logout_all_sessions endpoint is as follows;
   
   1) require the username and password in the request body (the request must prove knowledge of these values to proceed)
   2) if user:pass is correct, generate a new random salt value and save updated password_sha, salt (or derived_key, salt if using pbkdf2)
   
   All already issued session cookies are invalid, as the user salt is incorporated into them all. This is done so that a password change invalidates all session cookies, but it would be simple to reuse this mechanism for a forced logout feature.
   
   @wohali @janl 

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services