Active session improvements

[Bertg]

We are starting to implement the active_sessions feature in our setup.
However we are already looking into expanding/changing some of its features.

I was wondering if these would be useful for the main project. If so we can port them back to the repo, if they would be accepted.

1. Allow a configuration to disable remove_inactive_sessions during the web request. Also document then how to do this task in a background process.
2. Add a session name This can help identify the session for a user. By default this could be populated with the browser name for example.
3. Remove specific session Based on the previous idea, provide an interface for the end-user to delete specific sessions.
4. Post logout remove_all_active_sessions We want the user to be able to sign-out without "first" having to decide if they want to also sign out other sessions. Therefor we would like it to be possible to remove_all_active_sessions for a short time after logout has completed.
5. Paranoid sessions When a user logs out, instead of deleting the session DB entry, set a logout_at timestamp. This can be useful for several reasons. One would be to support the previous feature, but also stats like "counting active_sessions this month" without having to use the audit log feature.

Would be happy to discuss these ideas. Which ones could be added to the main active_sessions feature. Maybe these ideas can be an other feature to enable (ex: managed_active_sessions for feature 2 & 3). Or are these not suited for the main project and should we consider making these separate gems?

[renchap]

Add a session name This can help identify the session for a user. By default this could be populated with the browser name for example.

This is already supported, but not well documented, see #159

[jeremyevans]

1. remove_inactive_sessions{} in your rodauth configuration will make it a no-op, avoiding the delete query. Doing it in a background process would just involve deleting the rows from the related table. I'd accept a pull request for a guide (under doc/guides) for how to do that.
2. As @renchap mentioned, active_session_insert_hash should allow for doing that. I don't want to support session names by default, as I think the concerns there are going to be too application-specific, and not general enough. For example, some users might need to record multiple pieces of information (IP, user agent), and not a single name.
3. Since session names aren't supported by default, support for removing a specific session wouldn't make much sense. I do understand that desire for this, but I think it is too application-specific for inclusion in the framework.
4. You can do the equivalent of remove_all_active_sessions at any time for the user by deleting rows in the related table. I suppose we could make that easier by making it possible to do that via an internal request. Is that something you think would be beneficial?
5. I don't think think it makes sense to support this by default. You can use remove_current_session and remove_all_active_sessions to do an update instead of a delete, so it sounds like that can already handle your need.

One thing to realize about Rodauth is the goal is not to implement solutions to every possible application need. Instead, the goal is to be flexible enough that most application needs can be handled using the configuration methods.

Definitely you could handle these needs via external Rodauth features that depend on the active_sessions feature. I would be leaning against including such a feature in Rodauth, though I would consider it if there was broad community support for it. I would also consider backwards-compatible changes to active_sessions to better support such a feature, such as extracting additional methods.

[Bertg]

Understood.

I think in case of point 4, there is no direct need from me to have that available as an internal request. It's welcome, but not required.
As I see it, I think it would be best for the project that we write up a guide on some off these points once we are happy with how we implemented it.

[janko]

Post logout remove_all_active_sessions We want the user to be able to sign-out without "first" having to decide if they want to also sign out other sessions. Therefor we would like it to be possible to remove_all_active_sessions for a short time after logout has completed.

Note that you can do this easily in rodauth-rails when using Active Record, through the association defined by the model mixin:

account = Account.find(account_id)
account.active_session_keys.delete_all

or if you want to use remove_all_active_sessions:

rodauth = Rodauth::Rails.rodauth(account_id: account_id)
rodauth.remove_all_active_sessions

[Bertg]

Yeah, we are using rodauth-rails, we love it.