Per-device token cleanup: pass a stable device id from clients #260

New Issue

2026-11-02T13:45:55Z

raucao commented

2026-11-02 13:45:55 +00:00

Follow-up to #254. Since the silent token reuse was removed, every authorization is a distinct per-device token. The server has no reliable way to tell that a new authorization comes from the same device as an existing one, so a re-authorization after a user-agent change (browser update, reinstall, storage cleared) leaves an extra, still-valid token behind. The dashboard groups authorizations by app and device for manual cleanup (#258), but does not merge them.

Server-side heuristics don't work well:

Exact user-agent matching both merges two identically-configured machines and misses user-agent changes.
A first-party device cookie works in normal browsers but not in embedded clients. remoteStorage.js opens the OAuth page in a Cordova InAppBrowser created with clearsessioncache=yes,clearcache=yes, and other webviews use isolated or ephemeral cookie stores.

Proposal

Have clients send a stable, client-persisted device identifier with the authorization request (e.g. a device_id parameter), and let the server match on (user, client_id, device_id) to supersede the previous authorization for that device.

remoteStorage.js: generate a random device id once, persist it alongside its settings, and include it in the authorization request.
akkounts: store the id and supersede by it when present; ignore it when absent (no behavior change for clients that don't send one).

Reference #254.

Follow-up to #254. Since the silent token reuse was removed, every authorization is a distinct per-device token. The server has no reliable way to tell that a new authorization comes from the same device as an existing one, so a re-authorization after a user-agent change (browser update, reinstall, storage cleared) leaves an extra, still-valid token behind. The dashboard groups authorizations by app and device for manual cleanup (#258), but does not merge them. Server-side heuristics don't work well: - Exact user-agent matching both merges two identically-configured machines and misses user-agent changes. - A first-party device cookie works in normal browsers but not in embedded clients. remoteStorage.js opens the OAuth page in a Cordova InAppBrowser created with `clearsessioncache=yes,clearcache=yes`, and other webviews use isolated or ephemeral cookie stores. ## Proposal Have clients send a stable, client-persisted device identifier with the authorization request (e.g. a `device_id` parameter), and let the server match on `(user, client_id, device_id)` to supersede the previous authorization for that device. - remoteStorage.js: generate a random device id once, persist it alongside its settings, and include it in the authorization request. - akkounts: store the id and supersede by it when present; ignore it when absent (no behavior change for clients that don't send one). Reference #254.

raucao added the

integration

remotestorage

label 2026-11-02 13:45:55 +00:00

raucao added the feature idea labels 2026-11-02 14:09:37 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/akkounts#260