mirror of
https://github.com/n8n-io/n8n.git
synced 2026-10-21 20:20:03 +02:00
2177fe1d89
Some checks failed
CI: Python / Checks (push) Has been cancelled
Add a per-login session registry so users can see the browsers and devices signed in to their account and revoke individual sessions or all other sessions from their personal settings. Backend: - New user_login_session entity, migration and repository, keyed by a session id embedded as the JWT jti claim. - LoginSessionService owns the session lifecycle (create on login, touch on refresh, list, revoke, revoke-all-others) and prunes expired rows on read. - The session check is enforced in validateToken, so every auth path (interactive, webhook cookie auth, dynamic credentials) rejects a revoked or logged-out session. Tokens issued before this change carry no jti and fall back to the existing checks until they expire, so no one is logged out on upgrade. - Password change, email change and MFA enable/disable revoke the user's other sessions. - /me/login-sessions endpoints (list, revoke one, revoke all others). Frontend: - Login sessions section in personal settings listing device, IP, last active and sign-in time, with the current session flagged and per-row revoke plus a revoke-all-others action. |
||
|---|---|---|
| .. | ||
| @n8n | ||
| editor-ui | ||
| AGENTS.md | ||
| CLAUDE.md | ||