Logout of all devices, NodeJS and Angular 6










-3














I'm developing an application, the NodeJs (along with express) will be server side which will provide RESTfull service and Angular 6 will utilize the RESTfull API.
Now the problem is when a user change the password, then how to logout the user from all devices.



I'm using JWT for authentication.










share|improve this question





















  • What do you mean by all devices? Do you log user in mobile, desktop... or multiple devices?
    – Maihan Nijat
    Nov 9 at 19:37











  • How do you store login tokens? If it's in the database, you should remove all tokens from this user after the user has changed his password
    – Variable
    Nov 9 at 19:45











  • Currently, the NodeJS return a JWT Token, which I save in the localStorage, I don't know whats the best practice
    – AbdulRehman
    Nov 9 at 19:54










  • @Variable If i store the token in database, then should I have to check it (perform database query) at each request, which is a costly job
    – AbdulRehman
    Nov 9 at 20:00















-3














I'm developing an application, the NodeJs (along with express) will be server side which will provide RESTfull service and Angular 6 will utilize the RESTfull API.
Now the problem is when a user change the password, then how to logout the user from all devices.



I'm using JWT for authentication.










share|improve this question





















  • What do you mean by all devices? Do you log user in mobile, desktop... or multiple devices?
    – Maihan Nijat
    Nov 9 at 19:37











  • How do you store login tokens? If it's in the database, you should remove all tokens from this user after the user has changed his password
    – Variable
    Nov 9 at 19:45











  • Currently, the NodeJS return a JWT Token, which I save in the localStorage, I don't know whats the best practice
    – AbdulRehman
    Nov 9 at 19:54










  • @Variable If i store the token in database, then should I have to check it (perform database query) at each request, which is a costly job
    – AbdulRehman
    Nov 9 at 20:00













-3












-3








-3







I'm developing an application, the NodeJs (along with express) will be server side which will provide RESTfull service and Angular 6 will utilize the RESTfull API.
Now the problem is when a user change the password, then how to logout the user from all devices.



I'm using JWT for authentication.










share|improve this question













I'm developing an application, the NodeJs (along with express) will be server side which will provide RESTfull service and Angular 6 will utilize the RESTfull API.
Now the problem is when a user change the password, then how to logout the user from all devices.



I'm using JWT for authentication.







node.js angular jwt






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Nov 9 at 19:36









AbdulRehman

61




61











  • What do you mean by all devices? Do you log user in mobile, desktop... or multiple devices?
    – Maihan Nijat
    Nov 9 at 19:37











  • How do you store login tokens? If it's in the database, you should remove all tokens from this user after the user has changed his password
    – Variable
    Nov 9 at 19:45











  • Currently, the NodeJS return a JWT Token, which I save in the localStorage, I don't know whats the best practice
    – AbdulRehman
    Nov 9 at 19:54










  • @Variable If i store the token in database, then should I have to check it (perform database query) at each request, which is a costly job
    – AbdulRehman
    Nov 9 at 20:00
















  • What do you mean by all devices? Do you log user in mobile, desktop... or multiple devices?
    – Maihan Nijat
    Nov 9 at 19:37











  • How do you store login tokens? If it's in the database, you should remove all tokens from this user after the user has changed his password
    – Variable
    Nov 9 at 19:45











  • Currently, the NodeJS return a JWT Token, which I save in the localStorage, I don't know whats the best practice
    – AbdulRehman
    Nov 9 at 19:54










  • @Variable If i store the token in database, then should I have to check it (perform database query) at each request, which is a costly job
    – AbdulRehman
    Nov 9 at 20:00















What do you mean by all devices? Do you log user in mobile, desktop... or multiple devices?
– Maihan Nijat
Nov 9 at 19:37





What do you mean by all devices? Do you log user in mobile, desktop... or multiple devices?
– Maihan Nijat
Nov 9 at 19:37













How do you store login tokens? If it's in the database, you should remove all tokens from this user after the user has changed his password
– Variable
Nov 9 at 19:45





How do you store login tokens? If it's in the database, you should remove all tokens from this user after the user has changed his password
– Variable
Nov 9 at 19:45













Currently, the NodeJS return a JWT Token, which I save in the localStorage, I don't know whats the best practice
– AbdulRehman
Nov 9 at 19:54




Currently, the NodeJS return a JWT Token, which I save in the localStorage, I don't know whats the best practice
– AbdulRehman
Nov 9 at 19:54












@Variable If i store the token in database, then should I have to check it (perform database query) at each request, which is a costly job
– AbdulRehman
Nov 9 at 20:00




@Variable If i store the token in database, then should I have to check it (perform database query) at each request, which is a costly job
– AbdulRehman
Nov 9 at 20:00












1 Answer
1






active

oldest

votes


















0














It is bad practise to logout the user when it changes password unless user voluntarily opts to logout from all the devices:-



Once the user logout , then clears localstorage and redirect to login as:-



Just change the authorization token when user updates the password and check that token is still valid for each request. If not valid, gives 401 error and then redirect to login page.



logout()
/* clear your localStorage token /*
// redirect to login page



interceptor.ts



 import Injectable from '@angular/core';
import HttpRequest, HttpHandler, HttpEvent, HttpInterceptor from '@angular/common/http';
import Observable from 'rxjs';

@Injectable()
export class JwtInterceptor implements HttpInterceptor
intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>>
// add authorization header with jwt token if available
let currentUser = JSON.parse(localStorage.getItem('currentUser'));
if (currentUser && currentUser.token)
request = request.clone(
setHeaders:
Authorization: `Bearer $currentUser.token`

);


return next.handle(request).do((event: HttpEvent<any>) =>
if (event instanceof HttpResponse)
// do stuff with response if you want

, (err: any) =>
if (err instanceof HttpErrorResponse)
if (err.status === 401)
// redirect to the login route
// or show a modal showing, we are redirecting to you login page.


);




Refer Link:- https://medium.com/@ryanchenkie_40935/angular-authentication-using-the-http-client-and-http-interceptors-2f9d1540eb8



http://jasonwatmore.com/post/2018/05/23/angular-6-jwt-authentication-example-tutorial






share|improve this answer






















  • Thanks for your response, but let me discuss a 'use case' - A user login in multiple places (chrome, safari, mozilla), he then changes the password in chrome, Now the tokens in safari and mozilla should be no longer accepted, how to handle this
    – AbdulRehman
    Nov 10 at 13:47











  • What is 'use case' ?
    – Mahi
    Nov 10 at 13:50










  • So, what interceptor is doing here, it is using Authorization token with each and every request. Thus, in backend if there is something handled to check requested Authorization taken i.e. if Authorization token not matches then it will send 401 error . This works even if browser is refreshed. Thus , in other devices if browser is refreshed, then it will give 401 error.
    – Mahi
    Nov 10 at 13:59











  • You can even have a look at socket.io. Have a look at stackoverflow.com/questions/30814330/…
    – Mahi
    Nov 10 at 14:04











Your Answer






StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53232243%2flogout-of-all-devices-nodejs-and-angular-6%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









0














It is bad practise to logout the user when it changes password unless user voluntarily opts to logout from all the devices:-



Once the user logout , then clears localstorage and redirect to login as:-



Just change the authorization token when user updates the password and check that token is still valid for each request. If not valid, gives 401 error and then redirect to login page.



logout()
/* clear your localStorage token /*
// redirect to login page



interceptor.ts



 import Injectable from '@angular/core';
import HttpRequest, HttpHandler, HttpEvent, HttpInterceptor from '@angular/common/http';
import Observable from 'rxjs';

@Injectable()
export class JwtInterceptor implements HttpInterceptor
intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>>
// add authorization header with jwt token if available
let currentUser = JSON.parse(localStorage.getItem('currentUser'));
if (currentUser && currentUser.token)
request = request.clone(
setHeaders:
Authorization: `Bearer $currentUser.token`

);


return next.handle(request).do((event: HttpEvent<any>) =>
if (event instanceof HttpResponse)
// do stuff with response if you want

, (err: any) =>
if (err instanceof HttpErrorResponse)
if (err.status === 401)
// redirect to the login route
// or show a modal showing, we are redirecting to you login page.


);




Refer Link:- https://medium.com/@ryanchenkie_40935/angular-authentication-using-the-http-client-and-http-interceptors-2f9d1540eb8



http://jasonwatmore.com/post/2018/05/23/angular-6-jwt-authentication-example-tutorial






share|improve this answer






















  • Thanks for your response, but let me discuss a 'use case' - A user login in multiple places (chrome, safari, mozilla), he then changes the password in chrome, Now the tokens in safari and mozilla should be no longer accepted, how to handle this
    – AbdulRehman
    Nov 10 at 13:47











  • What is 'use case' ?
    – Mahi
    Nov 10 at 13:50










  • So, what interceptor is doing here, it is using Authorization token with each and every request. Thus, in backend if there is something handled to check requested Authorization taken i.e. if Authorization token not matches then it will send 401 error . This works even if browser is refreshed. Thus , in other devices if browser is refreshed, then it will give 401 error.
    – Mahi
    Nov 10 at 13:59











  • You can even have a look at socket.io. Have a look at stackoverflow.com/questions/30814330/…
    – Mahi
    Nov 10 at 14:04
















0














It is bad practise to logout the user when it changes password unless user voluntarily opts to logout from all the devices:-



Once the user logout , then clears localstorage and redirect to login as:-



Just change the authorization token when user updates the password and check that token is still valid for each request. If not valid, gives 401 error and then redirect to login page.



logout()
/* clear your localStorage token /*
// redirect to login page



interceptor.ts



 import Injectable from '@angular/core';
import HttpRequest, HttpHandler, HttpEvent, HttpInterceptor from '@angular/common/http';
import Observable from 'rxjs';

@Injectable()
export class JwtInterceptor implements HttpInterceptor
intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>>
// add authorization header with jwt token if available
let currentUser = JSON.parse(localStorage.getItem('currentUser'));
if (currentUser && currentUser.token)
request = request.clone(
setHeaders:
Authorization: `Bearer $currentUser.token`

);


return next.handle(request).do((event: HttpEvent<any>) =>
if (event instanceof HttpResponse)
// do stuff with response if you want

, (err: any) =>
if (err instanceof HttpErrorResponse)
if (err.status === 401)
// redirect to the login route
// or show a modal showing, we are redirecting to you login page.


);




Refer Link:- https://medium.com/@ryanchenkie_40935/angular-authentication-using-the-http-client-and-http-interceptors-2f9d1540eb8



http://jasonwatmore.com/post/2018/05/23/angular-6-jwt-authentication-example-tutorial






share|improve this answer






















  • Thanks for your response, but let me discuss a 'use case' - A user login in multiple places (chrome, safari, mozilla), he then changes the password in chrome, Now the tokens in safari and mozilla should be no longer accepted, how to handle this
    – AbdulRehman
    Nov 10 at 13:47











  • What is 'use case' ?
    – Mahi
    Nov 10 at 13:50










  • So, what interceptor is doing here, it is using Authorization token with each and every request. Thus, in backend if there is something handled to check requested Authorization taken i.e. if Authorization token not matches then it will send 401 error . This works even if browser is refreshed. Thus , in other devices if browser is refreshed, then it will give 401 error.
    – Mahi
    Nov 10 at 13:59











  • You can even have a look at socket.io. Have a look at stackoverflow.com/questions/30814330/…
    – Mahi
    Nov 10 at 14:04














0












0








0






It is bad practise to logout the user when it changes password unless user voluntarily opts to logout from all the devices:-



Once the user logout , then clears localstorage and redirect to login as:-



Just change the authorization token when user updates the password and check that token is still valid for each request. If not valid, gives 401 error and then redirect to login page.



logout()
/* clear your localStorage token /*
// redirect to login page



interceptor.ts



 import Injectable from '@angular/core';
import HttpRequest, HttpHandler, HttpEvent, HttpInterceptor from '@angular/common/http';
import Observable from 'rxjs';

@Injectable()
export class JwtInterceptor implements HttpInterceptor
intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>>
// add authorization header with jwt token if available
let currentUser = JSON.parse(localStorage.getItem('currentUser'));
if (currentUser && currentUser.token)
request = request.clone(
setHeaders:
Authorization: `Bearer $currentUser.token`

);


return next.handle(request).do((event: HttpEvent<any>) =>
if (event instanceof HttpResponse)
// do stuff with response if you want

, (err: any) =>
if (err instanceof HttpErrorResponse)
if (err.status === 401)
// redirect to the login route
// or show a modal showing, we are redirecting to you login page.


);




Refer Link:- https://medium.com/@ryanchenkie_40935/angular-authentication-using-the-http-client-and-http-interceptors-2f9d1540eb8



http://jasonwatmore.com/post/2018/05/23/angular-6-jwt-authentication-example-tutorial






share|improve this answer














It is bad practise to logout the user when it changes password unless user voluntarily opts to logout from all the devices:-



Once the user logout , then clears localstorage and redirect to login as:-



Just change the authorization token when user updates the password and check that token is still valid for each request. If not valid, gives 401 error and then redirect to login page.



logout()
/* clear your localStorage token /*
// redirect to login page



interceptor.ts



 import Injectable from '@angular/core';
import HttpRequest, HttpHandler, HttpEvent, HttpInterceptor from '@angular/common/http';
import Observable from 'rxjs';

@Injectable()
export class JwtInterceptor implements HttpInterceptor
intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>>
// add authorization header with jwt token if available
let currentUser = JSON.parse(localStorage.getItem('currentUser'));
if (currentUser && currentUser.token)
request = request.clone(
setHeaders:
Authorization: `Bearer $currentUser.token`

);


return next.handle(request).do((event: HttpEvent<any>) =>
if (event instanceof HttpResponse)
// do stuff with response if you want

, (err: any) =>
if (err instanceof HttpErrorResponse)
if (err.status === 401)
// redirect to the login route
// or show a modal showing, we are redirecting to you login page.


);




Refer Link:- https://medium.com/@ryanchenkie_40935/angular-authentication-using-the-http-client-and-http-interceptors-2f9d1540eb8



http://jasonwatmore.com/post/2018/05/23/angular-6-jwt-authentication-example-tutorial







share|improve this answer














share|improve this answer



share|improve this answer








edited Nov 9 at 21:21

























answered Nov 9 at 21:07









Mahi

685319




685319











  • Thanks for your response, but let me discuss a 'use case' - A user login in multiple places (chrome, safari, mozilla), he then changes the password in chrome, Now the tokens in safari and mozilla should be no longer accepted, how to handle this
    – AbdulRehman
    Nov 10 at 13:47











  • What is 'use case' ?
    – Mahi
    Nov 10 at 13:50










  • So, what interceptor is doing here, it is using Authorization token with each and every request. Thus, in backend if there is something handled to check requested Authorization taken i.e. if Authorization token not matches then it will send 401 error . This works even if browser is refreshed. Thus , in other devices if browser is refreshed, then it will give 401 error.
    – Mahi
    Nov 10 at 13:59











  • You can even have a look at socket.io. Have a look at stackoverflow.com/questions/30814330/…
    – Mahi
    Nov 10 at 14:04

















  • Thanks for your response, but let me discuss a 'use case' - A user login in multiple places (chrome, safari, mozilla), he then changes the password in chrome, Now the tokens in safari and mozilla should be no longer accepted, how to handle this
    – AbdulRehman
    Nov 10 at 13:47











  • What is 'use case' ?
    – Mahi
    Nov 10 at 13:50










  • So, what interceptor is doing here, it is using Authorization token with each and every request. Thus, in backend if there is something handled to check requested Authorization taken i.e. if Authorization token not matches then it will send 401 error . This works even if browser is refreshed. Thus , in other devices if browser is refreshed, then it will give 401 error.
    – Mahi
    Nov 10 at 13:59











  • You can even have a look at socket.io. Have a look at stackoverflow.com/questions/30814330/…
    – Mahi
    Nov 10 at 14:04
















Thanks for your response, but let me discuss a 'use case' - A user login in multiple places (chrome, safari, mozilla), he then changes the password in chrome, Now the tokens in safari and mozilla should be no longer accepted, how to handle this
– AbdulRehman
Nov 10 at 13:47





Thanks for your response, but let me discuss a 'use case' - A user login in multiple places (chrome, safari, mozilla), he then changes the password in chrome, Now the tokens in safari and mozilla should be no longer accepted, how to handle this
– AbdulRehman
Nov 10 at 13:47













What is 'use case' ?
– Mahi
Nov 10 at 13:50




What is 'use case' ?
– Mahi
Nov 10 at 13:50












So, what interceptor is doing here, it is using Authorization token with each and every request. Thus, in backend if there is something handled to check requested Authorization taken i.e. if Authorization token not matches then it will send 401 error . This works even if browser is refreshed. Thus , in other devices if browser is refreshed, then it will give 401 error.
– Mahi
Nov 10 at 13:59





So, what interceptor is doing here, it is using Authorization token with each and every request. Thus, in backend if there is something handled to check requested Authorization taken i.e. if Authorization token not matches then it will send 401 error . This works even if browser is refreshed. Thus , in other devices if browser is refreshed, then it will give 401 error.
– Mahi
Nov 10 at 13:59













You can even have a look at socket.io. Have a look at stackoverflow.com/questions/30814330/…
– Mahi
Nov 10 at 14:04





You can even have a look at socket.io. Have a look at stackoverflow.com/questions/30814330/…
– Mahi
Nov 10 at 14:04


















draft saved

draft discarded
















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.





Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


Please pay close attention to the following guidance:


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53232243%2flogout-of-all-devices-nodejs-and-angular-6%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

𛂒𛀶,𛀽𛀑𛂀𛃧𛂓𛀙𛃆𛃑𛃷𛂟𛁡𛀢𛀟𛁤𛂽𛁕𛁪𛂟𛂯,𛁞𛂧𛀴𛁄𛁠𛁼𛂿𛀤 𛂘,𛁺𛂾𛃭𛃭𛃵𛀺,𛂣𛃍𛂖𛃶 𛀸𛃀𛂖𛁶𛁏𛁚 𛂢𛂞 𛁰𛂆𛀔,𛁸𛀽𛁓𛃋𛂇𛃧𛀧𛃣𛂐𛃇,𛂂𛃻𛃲𛁬𛃞𛀧𛃃𛀅 𛂭𛁠𛁡𛃇𛀷𛃓𛁥,𛁙𛁘𛁞𛃸𛁸𛃣𛁜,𛂛,𛃿,𛁯𛂘𛂌𛃛𛁱𛃌𛂈𛂇 𛁊𛃲,𛀕𛃴𛀜 𛀶𛂆𛀶𛃟𛂉𛀣,𛂐𛁞𛁾 𛁷𛂑𛁳𛂯𛀬𛃅,𛃶𛁼

Crossroads (UK TV series)

ữḛḳṊẴ ẋ,Ẩṙ,ỹḛẪẠứụỿṞṦ,Ṉẍừ,ứ Ị,Ḵ,ṏ ṇỪḎḰṰọửḊ ṾḨḮữẑỶṑỗḮṣṉẃ Ữẩụ,ṓ,ḹẕḪḫỞṿḭ ỒṱṨẁṋṜ ḅẈ ṉ ứṀḱṑỒḵ,ḏ,ḊḖỹẊ Ẻḷổ,ṥ ẔḲẪụḣể Ṱ ḭỏựẶ Ồ Ṩ,ẂḿṡḾồ ỗṗṡịṞẤḵṽẃ ṸḒẄẘ,ủẞẵṦṟầṓế