Page MenuHomePhabricator

Add a feature to track and terminate specific login sessions
Open, Needs TriagePublic

Description

In facebook ( https://www.facebook.com/settings?tab=security ), one can selectively log ones self out of other current sessions, but in Mediawiki, one is helpless if one wants to log out of a session for which one no longer has access to the terminal of.

Please implement being able to log out of selected other sessions, or at least a way of logging out of everything everywhere, short of changing one's password.

From the other task:

Currently, there’s no way for me to see which sessions are valid/active for my account on Wikimedia projects – if I want to be sure that I can’t be compromised by an old session, I have to change my password. It would be useful if MediaWiki instead offered a way to list those sessions, and ideally allowed me to selectively terminate them as well.

GitHub and Twitter have such a feature, for example:

In MediaWiki, this is currently offered by Extension:SecureSessions (CC @Parent5446), but that extension isn’t deployed on Wikimedia wikis and also doesn’t always work, for example due to T73066; in T73066#2386198, @Anomie outlined an alternative way to track sessions. I think it might be worth adding this as a core feature.

See also:
T55156: Provide option to force a login session to end within a certain time

Details

Reference
bz56212

Event Timeline

bzimport raised the priority of this task from to Lowest.Nov 22 2014, 2:39 AM
bzimport set Reference to bz56212.
bzimport added a subscriber: Unknown Object (MLST).
Jidanni created this task.Oct 27 2013, 11:51 AM

Logging out already logs you out of all your sessions.

I mean lets say I have nine sessions, eight on various computers around my house and at the lab, and one back at Bob's friend's house. I want to just terminate the latter, because there are lots of weird people at his house and I'm not going back there this week. Why should I have to hurt all my other sessions just to zap that one like I can already do in Facebook?

I believe this is the purpose of [[mw:Extension:SecureSessions]].

[[mw:Extension:SecureSessions]] only allows you to log out all sessions at once, not individual sessions.

(In reply to comment #4)

[[mw:Extension:SecureSessions]] only allows you to log out all sessions at
once, not individual sessions.

Hmmm, interesting. So could this be a feature request for that extension, then?

What if the ability to logout itself was left to an extension?

Then only users of the 1% of the wikis where the administrator had the grace to install such extension could log out.

In this case we are forced to leave a hanging session available at Bob's house for anyone who would like to use it.

Therefore we see that such basic security should not be left for extensions, and thus belongs in the core.

What wiki users want is not a factor in determining what features are included in MediaWiki core. If only 1% of sysadmins install the extension on their wiki, it's not MediaWiki's responsibility to correct the others. In fact, it's better if sysadmins have the choice of what they want to provide to their users

In addition, there is very little reason to have a selective logout feature. Managing sessions is usually done for security purposes, i.e., if you left your account logged in somewhere and you're worried somebody might use it. In these cases it is safer to just reset all sessions.

Tgr added a subscriber: Tgr.Sep 1 2015, 3:53 AM

[[mw:Extension:SecureSessions]] only allows you to log out all sessions at
once, not individual sessions.

Hmmm, interesting. So could this be a feature request for that extension, then?

Not a simple one, though. As long as you terminate all sessions at the same time, it is enough to keep a single token in the user table and replace it when every session needs to be logged out. For per-session logout, you would need some kind of table keeping track of sessions.

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 1 2015, 3:53 AM
QEDK raised the priority of this task from Lowest to Needs Triage.Apr 15 2020, 6:35 AM
QEDK updated the task description. (Show Details)
QEDK renamed this task from add ability to terminate certain login sessions to Add a feature to track and terminate specific login sessions.Apr 15 2020, 6:37 AM