feat(server): one session per signed-in browser (#4951)

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>

Author: nabokihms

api/v2/api.pb.go

@@ -304,14 +304,19 @@ message VerifyPasswordResp {
 // The user_id and connector_id are on the parent AuthSession message.
 message ClientAuthState {
   string client_id = 1;
-  bool active = 2;
-  int64 expires_at = 3;
-  int64 last_activity = 4;
-  int64 last_token_issued_at = 5;
+  int64 authenticated_at = 2;
+  int64 last_activity = 3;
+  int64 last_token_issued_at = 4;
+  // Whether this client was reached through another client's SSO sharing rather
+  // than by authenticating directly.
+  bool via_sso = 5;
 }
 
 // AuthSession represents a user's authentication session.
 message AuthSession {
+  // Random identifier of the session, published to clients as the "sid" claim. One
+  // signed-in browser is one session, so a user has as many as they have devices.
+  string id = 10;
   string user_id = 1;
   string connector_id = 2;
   repeated ClientAuthState client_states = 3;
@@ -325,8 +330,7 @@ message AuthSession {
 
 // GetAuthSessionReq is a request to retrieve an auth session.
 message GetAuthSessionReq {
-  string user_id = 1;
-  string connector_id = 2;
+  string id = 1;
 }
 
 // GetAuthSessionResp returns the auth session details.
@@ -338,6 +342,8 @@ message GetAuthSessionResp {
 message ListAuthSessionsReq {
   // Optional filter: if set, only sessions for this user are returned.
   string user_id = 1;
+  // Optional filter: if set, only sessions from this connector are returned.
+  string connector_id = 2;
 }
 
 // ListAuthSessionsResp returns a list of auth sessions.
@@ -348,8 +354,7 @@ message ListAuthSessionsResp {
 // DeleteAuthSessionReq is a request to delete an auth session.
 // Deleting a session also revokes all associated refresh tokens (consistent with logout behavior).
 message DeleteAuthSessionReq {
-  string user_id = 1;
-  string connector_id = 2;
+  string id = 1;
 }
 
 // DeleteAuthSessionResp returns the result of deleting an auth session.
@@ -567,9 +572,9 @@ service Dex {
   rpc RevokeRefresh(RevokeRefreshReq) returns (RevokeRefreshResp) {};
   // VerifyPassword returns whether a password matches a hash for a specific email or not.
   rpc VerifyPassword(VerifyPasswordReq) returns (VerifyPasswordResp) {};
-  // GetAuthSession returns an auth session by user and connector ID.
+  // GetAuthSession returns an auth session by its ID.
   rpc GetAuthSession(GetAuthSessionReq) returns (GetAuthSessionResp) {};
-  // ListAuthSessions lists auth sessions, optionally filtered by user_id.
+  // ListAuthSessions lists auth sessions, optionally filtered by user and connector.
   rpc ListAuthSessions(ListAuthSessionsReq) returns (ListAuthSessionsResp) {};
   // DeleteAuthSession deletes an auth session and revokes associated refresh tokens.
   rpc DeleteAuthSession(DeleteAuthSessionReq) returns (DeleteAuthSessionResp) {};

api/v2/api.proto

@@ -230,12 +230,15 @@ func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
 		// connector gave the user, refresh tokens under the encoded sub claim
 		// that ends up in tokens.
 		if data.UserID != "" {
-			if resp, err := s.admin.api.ListAuthSessions(ctx, &api.ListAuthSessionsReq{UserId: data.UserID}); err == nil {
+			req := &api.ListAuthSessionsReq{UserId: data.UserID, ConnectorId: data.ConnectorID}
+			if resp, err := s.admin.api.ListAuthSessions(ctx, req); err == nil {
 				for _, sess := range resp.Sessions {
 					data.Sessions = append(data.Sessions, AdminSession{
+						ID:          sess.Id,
 						UserID:      sess.UserId,
 						ConnectorID: sess.ConnectorId,
 						IPAddress:   sess.IpAddress,
+						UserAgent:   sess.UserAgent,
 						Created:     epochText(sess.CreatedAt),
 						Expires:     epochText(sess.AbsoluteExpiry),
 					})
@@ -446,9 +449,11 @@ func (s *Server) handleAdminRevokeRefresh(w http.ResponseWriter, r *http.Request
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
 
+	// The API keys refresh tokens by the sub claim, not by the user id the
+	// connector gave — the same encoding the listing above uses.
 	userID, clientID := r.FormValue("user_id"), r.FormValue("client_id")
 	resp, err := s.admin.api.RevokeRefresh(ctx, &api.RevokeRefreshReq{
-		UserId:   userID,
+		UserId:   idTokenSubject(userID, r.FormValue("connector_id")),
 		ClientId: clientID,
 	})
 	switch {
@@ -680,18 +685,16 @@ func (s *Server) handleAdminDeleteSession(w http.ResponseWriter, r *http.Request
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
 
-	userID := r.FormValue("user_id")
-	resp, err := s.admin.api.DeleteAuthSession(ctx, &api.DeleteAuthSessionReq{
-		UserId:      userID,
-		ConnectorId: r.FormValue("connector_id"),
-	})
+	// One session is one signed-in browser, so this ends that device and no other.
+	sessionID := r.FormValue("session_id")
+	resp, err := s.admin.api.DeleteAuthSession(ctx, &api.DeleteAuthSessionReq{Id: sessionID})
 	switch {
 	case err != nil:
 		s.adminRedirect(w, r, "", err.Error())
 	case resp.NotFound:
-		s.adminRedirect(w, r, "", fmt.Sprintf("no session for user %q", userID))
+		s.adminRedirect(w, r, "", fmt.Sprintf("no session %q", sessionID))
 	default:
-		s.adminRedirect(w, r, fmt.Sprintf("deleted session for user %q", userID), "")
+		s.adminRedirect(w, r, fmt.Sprintf("deleted session %q", sessionID), "")
 	}
 }
 

api/v2/api_grpc.pb.go

@@ -205,9 +205,11 @@ type DiscoveryEntry struct {
 
 // AdminSession is one of dex's own sessions as the API reports it.
 type AdminSession struct {
+	ID          string
 	UserID      string
 	ConnectorID string
 	IPAddress   string
+	UserAgent   string
 	Created     string
 	Expires     string
 }

examples/example-app/server/admin.go

@@ -314,8 +314,20 @@ document.querySelectorAll(".chip-remove").forEach(function (btn) {
 (function () {
     if (!window.EventSource) return;
 
+    // Only where the notice has something to say. A stream is a connection held
+    // open for as long as the page lives, and a browser allows six of them per
+    // host, so opening one from every page — the admin screens included — is how
+    // you starve the rest of the site of connections.
+    if (!document.getElementById("signed-in-card")) return;
+
     const stream = new EventSource("/events");
 
+    // Release the connection as the page goes away rather than waiting for the
+    // browser to notice, so a reload does not briefly hold two.
+    window.addEventListener("pagehide", function () {
+        stream.close();
+    });
+
     stream.addEventListener("backchannel-logout", function (event) {
         let notice = {};
         try {

examples/example-app/server/render.go

@@ -595,11 +595,13 @@
     <div class="subhead">Sessions</div>
     {{if .Sessions}}
     <table class="table">
-        <tr><th>Connector</th><th>From</th><th>Started</th><th>Expires</th><th class="actions-col"></th></tr>
+        <tr><th>Session</th><th>Connector</th><th>From</th><th>Device</th><th>Started</th><th>Expires</th><th class="actions-col"></th></tr>
         {{range .Sessions}}
         <tr>
+            <td class="mono small">{{.ID}}</td>
             <td class="mono small">{{.ConnectorID}}</td>
             <td class="mono small">{{.IPAddress}}</td>
+            <td class="mono small">{{.UserAgent}}</td>
             <td class="small">{{.Created}}</td>
             <td class="small">{{.Expires}}</td>
             <td class="actions-col">
@@ -608,8 +610,7 @@
                         <input type="hidden" name="section" value="sessions">
                         <input type="hidden" name="list_user_id" value="{{$.UserID}}">
                         <input type="hidden" name="list_connector_id" value="{{$.ConnectorID}}">
-                        <input type="hidden" name="user_id" value="{{.UserID}}">
-                        <input type="hidden" name="connector_id" value="{{.ConnectorID}}">
+                        <input type="hidden" name="session_id" value="{{.ID}}">
                         <button type="submit" class="button button-small">Delete</button>
                     </form>
                 </div>