-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Duplicate Session Tokens for Users, Not Overwriting Sessions #4907
Comments
This has been fixed in the latests parse server versions, and sessions are properly destroyed for the same installation id. Also I’m not sure what passeport has to do with this. |
Passport is what I used to Authenticate, and hence create session entries/cookies for my own backend/framework I created. I did have some issues with sessions piling up but was able to manually code a fix. |
So... I’m not sure if the issue is with this project or your code then. |
THis is not my code, my implementation of Passport.js worked fine ... |
I also want to point out that sessions are unique per user/installationId pair. In your screenshot, all installationIds are different, so it makes sense a different session is created For each different installationId. You can think of a session as the user being logged in on a device, the session table let the user review it’s logged in sessions. From what I can see, all is valid. |
ok thanks than its very likely the bug since its version 2.7.1 . But our users don't log in from different devices, they do iOS phone or Android thats it. We have no web login, just 2 apps. When was the bug patched? since what version? |
I mean that the sessions are created with the installationId and as you show in your table, all sessions have different installationId which is expected. If the bug was still there, you would see many sessions for the same installationId. Yet, you have many sessions for a single user which points to some code that would create sessions from the server, like calling Parse.User.logIn from a server or cloud code as the installtionId is always different. Would it be the same it may point to an issue with your login process in the apps. Also, are you able to isolate logs when running with VERBOSE=1 when this issue is shown? Can you post such logs so we can see the issue ? |
Ah I see, but its still illogical to me to store too much data in a table, and this is mongoDB obv, I used PostGres. Will enable VERBOSE=1 saw it in a different post you mentioned and post it up thank you. |
The session is created because at one point, one should be created. If your users have many devices and multiple web browsers, the session table let them disconnect them all individually. Sessions represent a user logged in on a particular device. You should triple check your code for calls to logIn. |
Yah I personally think its a login call issue in iOS which there was a thread on here about with similar errors. Because each user doesnt have multiple devices , usually a phone. at most tablet and a phone. |
Issue Description
Duplicate Session Tokens for Same User Pointer
Steps to reproduce
New to Company/Codebase not my codebase otherwise i'd be able to fix it and would have used my own framework I already have written.
Expected Results
Users login and have their Session (passport.js) token expire accordingly or get deleted/overwritten
Actual Outcome
Multiple Sessions and not Overwriting
Environment Setup
Server
Database
Logs/Trace
Jul 19 15:07:04 prod app/web.1: error: Error generating response. ParseError { code: 101, message: 'Invalid username/password.' } code=101, message=Invalid username/password.
Jul 19 15:07:04 prod app/web.1: error: Invalid username/password. code=101, message=Invalid username/password.
Jul 19 15:06:58 prod app/web.1: info: Ran cloud function getParseUserForEmail for user undefined with:
Jul 19 15:15:01 prod app/web.1: error: invalid session token code=209, message=invalid session token
Jul 19 15:15:01 prod app/web.1: error: invalid session token code=209, message=invalid session token
Jul 19 15:15:01 prod app/web.1: error: invalid session token code=209, message=invalid session token
The text was updated successfully, but these errors were encountered: