Logout session

[ghost]

Feature Request

• Logout each sessions. (logout button) User Accounts for AdGuardHome #997
• Default timeout limit (session autologout)
• View and revoke active sessions.
• Sessions history and failed attempts. (log)
  (log timestamp by default and optional with IP)

[ghost]

One more thing, If restart current AGHome while logged-in then able re-establish session without require password. I think it's necessary to change :)

[ameshkov]

One more thing, If restart current AGHome while logged-in then able re-establish session without require password. I think it's necessary to change :)

Why, that's how it was supposed to work -- we store sessions in a tiny DB for that.

[ghost]

Why, that's how it was supposed to work -- we store sessions in a tiny DB for that.

As my opinion it must be limited as long as AGHome service running (optional: certain time period). Once restarted the service or get activated from any state, recent sessions should no longer be used however session history logs keep unless manually clear it.

Somehow if not prefer it and has any scenario to be user friendly then if decide to implement above *View and revoke active sessions feature will fulfill it ^_^

[ameshkov]

As my opinion it must be limited as long as AGHome service running (optional: certain time period).

Currently, session TTL is limited with 24 hours since the last use.

[szolin]

I suggest we start with the simple things first:

• add auth_session_expire 30d configuration setting
• make a button to delete all sessions, except the current one
• make info-level logging for failed login attempts
• make info-level logging for successful logins

[ameshkov]

@Archivebase could you please make a separate feature request for this one?

View and revoke active sessions.

It's definitely too complicated to have it here.

make a button to delete all sessions, except the current one

Tbh, I don't think this is necessary, session_ttl setting would be more than enough.

[ghost]

make info-level logging for failed login attempts
make info-level logging for successful logins

It might be better atleast last 5-10 attempts history viewable within web interface and rest stored in log, may includes each session start and end time with reason whether signout or timeout.
(additional: option to set in config to disable, basic* time:date, advanced* info level with IPs)

[ameshkov]

@Archivebase I guess "viewable login history" should be also a separate feature request then.