Scenario: User one starts a browser and connects to the Forum using SSO, works for a while and then closes browser. User two starts a browser on the same machine and logs into the Forum again using SSO. The process takes him through the full login with his credentials but when he enters the forum he is logged in as User one. Discourse will allow the session timeout to be set to a minimum of one hour. This means that the user can return to the PC within one hour and simply log in and gain the identity of the previous user from cookies. There was a fix back in 2016 to allow the cookies to die when the browser was closed but this was reverted. This makes the software very insecure in an environment where multiple people use the same workstation if the browser has not been configured to work in private mode. Is there a fix to this? Thanks Peter

Same question, same answer: https://github.com/discourse/discourse/commit/09ef5f613ef5fdf74554707de1fdccc935c6b0b9 You can check the code from the above commit, that was reverted, and port it to a plugin to suit your needs. You can also code a logout integration in your SSO system, so when a user log outs it calls Discourse to terminate all existing sessions of the same user. And no, this is not considered a security flaw.

It is sad that the code was reverted as it had considerable value in situations like this. Can you please provide pointers to the Discourse calls necessary to terminate the sessions. Thanks Rafael

There is a handy guide about that here: [image]Synchronize SSO login state between Discourse and provider Logout When a user logout on the website, the website need to send a Discourse API request to this URL: http(s)://forum.example.com/admin/users/{user_id}/log_out The user_id here is the user ID in Discourse, it maybe different from the user ID in the website database.

How to sync logout with SSO or Browser session?

Product Support

Falco (Falco) September 8, 2020, 1:27pm 4

There is a handy guide about that here:

Topic		Replies	Views
Synchronize SSO login state between Discourse and provider Administrators sso , how-to	0	6778	April 5, 2017
How to log out user if I don't know them? Development	6	1299	March 26, 2020
Issues using SSO in custom web app Development	10	1691	January 9, 2018
SSO login & logout issues SSO	2	3637	August 12, 2016
Discourse members being logged out - how to fix? Product Support	11	1884	May 25, 2020

How to sync logout with SSO or Browser session?

Related topics