Merge pull request #5151 from mslourens/prevent_multiple_sessions

invalidate sessions before login
2022-04-06 22:18:17 +01:00 · 2022-04-06 22:18:17 +01:00 · bff43d37d5
parent bb7c4e1d41 5f91841a26
commit bff43d37d5
1 changed files with 3 additions and 0 deletions
--- a/packages/backend-core/src/security/sessions.js
+++ b/packages/backend-core/src/security/sessions.js
@ -15,6 +15,9 @@ function makeSessionID(userId, sessionId) {
 }

 exports.createASession = async (userId, session) => {
+  // invalidate all other sessions
+  await this.invalidateSessions(userId)
+
  const client = await redis.getSessionClient()
  const sessionId = session.sessionId
  if (!session.csrfToken) {