mirror of https://github.com/n8n-io/n8n.git synced 2026-10-22 12:31:57 +02:00

Ricardo Espinoza 2177fe1d89

CI: Python / Checks (push) Has been cancelled

Details

feat(core): Add login session management

Add a per-login session registry so users can see the browsers and devices
signed in to their account and revoke individual sessions or all other
sessions from their personal settings.

Backend:
- New user_login_session entity, migration and repository, keyed by a session
  id embedded as the JWT jti claim.
- LoginSessionService owns the session lifecycle (create on login, touch on
  refresh, list, revoke, revoke-all-others) and prunes expired rows on read.
- The session check is enforced in validateToken, so every auth path
  (interactive, webhook cookie auth, dynamic credentials) rejects a revoked or
  logged-out session. Tokens issued before this change carry no jti and fall
  back to the existing checks until they expire, so no one is logged out on
  upgrade.
- Password change, email change and MFA enable/disable revoke the user's other
  sessions.
- /me/login-sessions endpoints (list, revoke one, revoke all others).

Frontend:
- Login sessions section in personal settings listing device, IP, last active
  and sign-in time, with the current session flagged and per-row revoke plus a
  revoke-all-others action.

2026-07-01 17:28:11 -04:00

2.6 KiB

Raw Permalink Blame History

user_login_session

Description

Table Definition

CREATE TABLE "user_login_session" ("id" varchar(36) PRIMARY KEY NOT NULL, "userId" varchar NOT NULL, "browserIdHash" varchar(64), "userAgent" varchar(512), "ipAddress" varchar(45), "expiresAt" datetime(3) NOT NULL, "lastActiveAt" datetime(3), "createdAt" datetime(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')), "updatedAt" datetime(3) NOT NULL DEFAULT (STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')), CONSTRAINT "FK_043fbbc79e15a2f9999015d226f" FOREIGN KEY ("userId") REFERENCES "user" ("id") ON DELETE CASCADE)

Columns

Name	Type	Default	Nullable	Parents
browserIdHash	varchar(64)		true
createdAt	datetime(3)	STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')	false
expiresAt	datetime(3)		false
id	varchar(36)		false
ipAddress	varchar(45)		true
lastActiveAt	datetime(3)		true
updatedAt	datetime(3)	STRFTIME('%Y-%m-%d %H:%M:%f', 'NOW')	false
userAgent	varchar(512)		true
userId	varchar		false	user

Constraints

Name	Type	Definition
- (Foreign key ID: 0)	FOREIGN KEY	FOREIGN KEY (userId) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE
id	PRIMARY KEY	PRIMARY KEY (id)
sqlite_autoindex_user_login_session_1	PRIMARY KEY	PRIMARY KEY (id)

Indexes

Name	Definition
IDX_043fbbc79e15a2f9999015d226	CREATE INDEX "IDX_043fbbc79e15a2f9999015d226" ON "user_login_session" ("userId")
sqlite_autoindex_user_login_session_1	PRIMARY KEY (id)

Relations

erDiagram

"user_login_session" }o--|| "user" : "FOREIGN KEY (userId) REFERENCES user (id) ON UPDATE NO ACTION ON DELETE CASCADE MATCH NONE"

"user_login_session" {
  varchar_64_ browserIdHash
  datetime_3_ createdAt
  datetime_3_ expiresAt
  varchar_36_ id PK
  varchar_45_ ipAddress
  datetime_3_ lastActiveAt
  datetime_3_ updatedAt
  varchar_512_ userAgent
  varchar userId FK
}
"user" {
  datetime_3_ createdAt
  boolean disabled
  varchar_255_ email
  varchar_32_ firstName
  varchar id PK
  date lastActiveAt
  varchar_32_ lastName
  boolean mfaEnabled
  TEXT mfaRecoveryCodes
  TEXT mfaSecret
  varchar password
  TEXT personalizationAnswers
  varchar_128_ roleSlug FK
  TEXT settings
  datetime_3_ updatedAt
}

Generated by tbls

2.6 KiB Raw Permalink Blame History