在使用devise的Rails中：如何确定用户是否已从其他浏览器注销？

Question

Currently, I can tell if a user has singed in and how long it has been online, but I cannot find out if a user has signed out from a different browser when. Here is the current code I have so far:

- if current_user
 = "(last login #{time_ago_in_words(user.current_sign_in_at)} ago) - #{user.current_sign_in_at ? 'currently online' : ''}"
- else
 = "(last login #{time_ago_in_words(user.current_sign_in_at)} ago)"

Answer 1

As far as I know, there is nothing specific for this in Devise. You can track a particular user's session by storing a unique token specific to that user in the database.

Create a migration to add the field for storing the token.

Check the token for every logout and you can save the timestamp.

I think this way, you know when user has logged out from which browser.

Hope it helps!

Answer 2

You can try

Store a timestamp in your session so that you can timeout a session after a certain period of inactivity. If you use Devise, you can achieve this easily with the timeoutable module . This presents a slight conundrum: if you set the timeout too low, then it'll be pretty annoying for your users. But the longer the timeout, the less useful it is for security (if the attacker gets in before hitting the timeout, they can just keep refreshing to keep their session active).

Track active session ids on the server side (whilst still storing the actual session data in cookies). This means you can invalidate sessions whenever you want.

add a SessionActivation model to track which sessions are active. Here's the migration:

class AddUserActiveSessions < ActiveRecord::Migration
  def change
    create_table :session_activations do |t|
      t.integer :user_id,   null: false
      t.string :session_id, null: false
      t.timestamps
    end

    add_index :session_activations, :user_id
    add_index :session_activations, :session_id, unique: true
  end
end

Here's the class:

class SessionActivation < ActiveRecord::Base
  LIMIT = 20

  def self.active?(id)
    id && where(session_id: id).exists?
  end

  def self.activate(id)
    activation = create!(session_id: id)
    purge_old
    activation
  end

  def self.deactivate(id)
    return unless id
    where(session_id: id).delete_all
  end

  # For some reason using #delete_all causes the order/offset to be ignored
  def self.purge_old
    order("created_at desc").offset(LIMIT).destroy_all
  end

  def self.exclusive(id)
    where("session_id != ?", id).delete_all
  end
end

Make some changes to the User model:

class User < ActiveRecord::Base
  # ...

  has_many :session_activations, dependent: :destroy

  def activate_session
    session_activations.activate(SecureRandom.hex).session_id
  end

  def exclusive_session(id)
    session_activations.exclusive(id)
  end

  def session_active?(id)
    session_activations.active? id
  end


end