Hi All,For my client I'm buzzy with an application (Mobile and Reactive version) and we face the scenario where a give user changes his password in one of the app versions, for instance in the Reactive web, and the expected behavior is that the same user must to be in MOBILE app logged out so he could log in again with the new password. So I have done some research but nothing concrete for reactive web apps or mobile. I already saw some ideas with extra table with user Id, session GUID and validation on each screen or server interaction, a nice idea about terminate all sessions from given user (https://www.outsystems.com/ideas/1155/user-logout-optional-parameters/). Saw also some components like "AutoLogout" (Web traditional) but nothing to suit my use case.Any idea will be appreciated.Kind regards
Hey Alan,
This thread might be helpful for you
https://www.outsystems.com/forums/discussion/35093/how-to-log-out-a-specific-user/
Regards,
Kharlo
Hi Kharlo,
Unfortunately this thread refers to Traditional web apps. Thank you anyway.
Alan
A possible solution involves using Firebase, where logged-in users listen for specific events via a FirebaseReceiver. When a message is received, users can take action based on the received command. Conversely, when a password is changed, a Firebase notification (FirebaseNotifyEvent) is sent to other sessions belonging to the same user. It's important to ensure all user sessions are managed under a unified ID corresponding to the userId. Additionally, messages should be encrypted to guarantee that only messages intended for this specific purpose and sent by the current user are processed.
Does the loop correctly move to the next element in the data set? Verify that the Data Action returns the expected results and that there are no problems with filtering or sorting the data that are causing the same record to be repeated.
Hello everyone,
I'm revisiting this topic to check whether there have been any updates since this question was originally posted.
I'm trying to find out whether there's now a way to revoke all active sessions for a user in a Reactive application.
Our main use case is allowing a user to force all of their active sessions to re-authenticate after changing their password. Another scenario is when an account needs to be immediately blocked for security reasons, preventing the user from continuing to use the application.
The previous suggestions mentioned using events via a FirebaseReceiver or implementing a custom validation mechanism. We currently have a validation on every server call to check whether the user's session should be terminated. While this works, it adds extra load on both the application and the database, so we're hoping there's now a more efficient or built-in approach.
Has OutSystems introduced any new functionality or a recommended pattern to invalidate all active sessions for a specific user?
Best regards