Concurrent sessions allowed across devices with no notification or revocation #140

New issue

Open

opened 2026-04-02 19:51:06 +00:00 by xenushka · 1 comment

xenushka commented

2026-04-02 19:51:06 +00:00

(Migrated from codeberg.org)

Summary
Multiple simultaneous sessions are permitted from different Qubes/devices with no notification or visibility to the user.

Steps to Reproduce

Register and log in via dashboard on dev qube
Log in with the same passkey on distrust qube
Both sessions remain active concurrently

Expected Behavior
At minimum, the user should be notified of a new session from a new device. Ideally, users should be able to view and revoke active sessions.

Actual Behavior
Both sessions are silently active with no indication to the user.

Security Impact
If a session cookie is compromised, an attacker can maintain a parallel session indefinitely with no signal to the legitimate user. This is inconsistent with the trust model of the platform.

Suggested Fix (pick one or more)

Enforce single-session: new login invalidates all prior sessions
Add a session management UI showing active devices with revoke option
Send email notification when a new session is initiated from a new device

Verified via
Two separate browser sessions on two different machines, both authenticated simultaneously.

**Summary** Multiple simultaneous sessions are permitted from different Qubes/devices with no notification or visibility to the user. **Steps to Reproduce** 1. Register and log in via dashboard on dev qube 2. Log in with the same passkey on distrust qube 3. Both sessions remain active concurrently **Expected Behavior** At minimum, the user should be notified of a new session from a new device. Ideally, users should be able to view and revoke active sessions. **Actual Behavior** Both sessions are silently active with no indication to the user. **Security Impact** If a session cookie is compromised, an attacker can maintain a parallel session indefinitely with no signal to the legitimate user. This is inconsistent with the trust model of the platform. **Suggested Fix (pick one or more)** - Enforce single-session: new login invalidates all prior sessions - Add a session management UI showing active devices with revoke option - Send email notification when a new session is initiated from a new device **Verified via** Two separate browser sessions on two different machines, both authenticated simultaneously.

ryansquared commented

2026-06-26 23:56:16 +00:00

(Migrated from codeberg.org)

Enforce single-session: new login invalidates all prior sessions

This is super annoying if anyone's on the dashboard while also doing things on the CLI, and every time I find an application that does this, it tends to bother me.

Add a session management UI showing active devices with revoke option

This definitely seems like a good idea.

Send email notification when a new session is initiated from a new device

Also a good idea, but what are we considering "new"? Do we fingerprint clients and go based on that? That could be some GDPR or California privacy regulation wonkiness.

> Enforce single-session: new login invalidates all prior sessions This is super annoying if anyone's on the dashboard while also doing things on the CLI, and every time I find an application that does this, it tends to bother me. >Add a session management UI showing active devices with revoke option This definitely seems like a good idea. > Send email notification when a new session is initiated from a new device Also a good idea, but what are we considering "new"? Do we fingerprint clients and go based on that? That could be some GDPR or California privacy regulation wonkiness.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

public/platform#140

No description provided.

Rows
Columns