Ask for authentication before removing 'Device & Sessions'
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
Describe the solution you'd like
As user
I want to make sure that when I remove a device or session from my NextCloud account I'm prompted to authenticate with my password
So that if my account is compromised no one can remove access without the original password
Additional context
I think this feature could help prevent users that leave their account open in a shared device from other users de-authenticating them from their devices and therefore loosing access.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Device & Sessions removal flow in the Nextcloud server and trace where device or session access is removed. Confirm how existing password authentication is handled before deciding where the prompt belongs. Done means removing a device or session requires the account password, including when the account is open on a shared device.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100