Record Login sessions to restrict currently open sessions and allow users to delete session for old devices

[mediafinger]

Record Login sessions

Enhances security by:

• automatically invalidating sessions on less recently used devices
• allowing the user to see the last 3 devices used to login
• allowing the user to remove all login sessions, leading to a logout on the affected devices

Implementation

A new module Logins is included in the ApplicationController.

• This module creates a new Login record everytime a user logs in from a new device.
• If the device _(== hashed IP address & useragent) has been used before, the Login record's timestamp will be updated.
• Older Login records of the same user will be deleted after every new login, we keep only the 3 most recently used ones.
• Deleting a Login record invalidates the session - and effectively logs the user out from the other device.
• When logging out, the Login record will also be deleted.

Chimera HTTP Client

HTTP Client gem used to connect to the Geoapify API to translate an IP address to a location.

• https://github.com/mediafinger/chimera_http_client
• based on the typhoeus gem, which wraps libcurl

Device Detector

Gem to translate user_agent strings into human readable information

• https://github.com/podigee/device_detector/
• no external dependencies