Merge pull request #5151 from mslourens/prevent_multiple_sessions

invalidate sessions before login
5 years ago · d7dbaef8be
1 changed files with 3 additions and 0 deletions
--- a/packages/backend-core/src/security/sessions.js
+++ b/packages/backend-core/src/security/sessions.js
@ -15,6 +15,9 @@ function makeSessionID(userId, sessionId) {
 }

 exports.createASession = async (userId, session) => {
+  // invalidate all other sessions
+  await this.invalidateSessions(userId)
+
  const client = await redis.getSessionClient()
  const sessionId = session.sessionId
  if (!session.csrfToken) {