What exactly goes on when DELETE /session/username is invoked?

sam · 2016 年12 月 9 日 00:44

app/controllers/session_controller.rb

master


      
            server_session["user_created_message"] = activation.message
            return redirect_to(users_account_created_path)
          else
            login_sso_user(sso, user)
          end
          
          # If it's not a relative URL check the host
          if return_path !~ %r{\A/[^/]}
            begin

github.com/discourse/discourse

lib/current_user.rb

5dbd6a304


      
          def log_off_user
            current_user_provider.log_off_user(session,cookies)
          end

github.com/discourse/discourse

lib/auth/default_current_user_provider.rb

b246f1a69


      
          def log_off_user(session, cookies)
            if SiteSetting.log_out_strict && (user = current_user)
              user.auth_token = nil
              user.save!
          
              if user.admin && defined?(Rack::MiniProfiler)
                # clear the profiling cookie to keep stuff tidy
                cookies.delete("__profilin")
              end
          
              user.logged_out
            end
            cookies.delete(TOKEN_COOKIE)
          end

I think what you are after is SiteSetting.log_out_strict

话题		回复	浏览量
How to fully logout user session plus clear oauth data SSO oauth2	0	1060	2023 年4 月 20 日
Is Discourse supposed to log you out across browsers? Feature	9	1932	2015 年9 月 21 日
How to log out user if I don't know them? Development	6	1286	2020 年3 月 26 日
A question about user_auth_tokens Development	4	1100	2017 年3 月 16 日
WordPress log out everywhere doesn't log out discourse WordPress	5	1036	2020 年6 月 24 日

What exactly goes on when DELETE /session/username is invoked?

相关话题