Passkeys and Auth::logoutOtherDevices

[CicerBro]

Fortify Version

Latest

Laravel Version

Latest

PHP Version

Latest

Database Driver & Version

Session driver is Redis

Description

In my app users can have one session, if they login elsewhere I always called Auth::logoutOtherDevices($password); during the login flow. Worked perfectly.

Now users can also login using passkeys, thus $password is not known. What would be the right approach here? I confirmed that when using passkeys you can have more than one session for the same user.

The logoutOtherDevices method rehashes the users password with the "new" one provided during login. It works, but is this really the way to invalidate all existing user sessions except the current/new one? Is there anything else to work with in Fortify/Laravel to make it work with login flows where the password isn't known?

Not sure if this is a Fortify issue actually, but I made the issue here since it's caused by passkeys basically.

Steps To Reproduce

See above.

[benbjurstrom]

Thanks for raising this. I’ll look at getting something into the framework that allows invalidating other sessions without requiring a password.

In the meantime for single-session behavior you could add a custom session token to the users table and rotate it after every successful login. Something like

$user->auth_session_token = Str::random(60);
$user->save();
$request->session()->put('auth_session_token', $user->auth_session_token);

Then add a middleware that logs the user out if the session token doesn't match what's in the user table.

[CicerBro]

Hi Ben,

Cheers. Yeah I had planned on doing the session token thing if there was nothing baked into the framework. Would be nice if there was some logic that something passkeys and passwords could share.

[CicerBro]

Is there aaaaany update on this by chance? :-)