spring-projects / spring-projects/spring-security
Remove all remembered tokens by just logging out from one device
Open
Nobody has claimed this yet.
status: waiting-for-triage
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Summary
By logging out the PersistentTokenBasedRememberMeServices removes all the tokens from database
that are tied to that username without considering the device he wants to logout.
Actual Behavior
- Login browser 1
- A cookie is created on the browser
- A remember me token is created in the database for that username
- Login browser 2
- A cookie is created on the browser
- A new remember me token is created in the database for that username
- Logout browser 1
- The cookie is deleted from the browser
- All the tokens are deleted from databases for that username regardless of their browser
- User tries to use the cookie on the second browser but the corresponding token is missing
Expected Behavior
On step 9 only the token corresponding to that session and cookie should be deleted
Configuration
No custom configuration
Version
4.2.3.RELEASE
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with PersistentTokenBasedRememberMeServices and trace the logout path that deletes database tokens. Reproduce the two-browser sequence described in the issue, then verify that logging out from one browser removes only its token while the other browser's token remains usable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100