Issue with automatic login about traccar-web HOT 9 CLOSED

I don't see security leak here. Even if I change the code of "auto-login module" to log off current user, you will be able to use your previous user account when you open traccar web UI directly. If your use case is to switch users on same computer and in same browser, then yes, you have to log off manually. I believe this behaviour is usual and expected for a majority of web applications.

from traccar-web.

I think you are right, that this is not a security issue.
But I do not agree that this bevaiour is expected.
If I call a link with included login data, I don't expect to see another acoount.
As I wrote, for me it is no problem.

So maybe we close this thread.

Btw. I just downloaded the latest version.
Great work.
I have one account with only device. This devices is now automatically in the list field of the archive; I did not dare to ask for that.

PS
What are the login credentials füor your demoweb site?

from traccar-web.

Well, ok, I will think about it. Let's leave this issue open.

PS you should register yourself on demo - there is a 'Register' button. Just fill your credentials and hit that button.

from traccar-web.

Hi,

Couldn't an option be added so that when the username changes, re-auths?

Best regards,
António

from traccar-web.

You are right, it can. My thought was to log off current user only if authentication succeeds.

from traccar-web.

If the username is different it's best to always force log off. That way, even if the auth fails, it doesn't display previous user data (it should prompt for new auth credentials).

from traccar-web.

If auth fails it prints 'Authentication failed'. By design this servlet's purpose is to try to authenticate, then redirect on success, print error on failure. I don't like the approach to add any UI to the servlet (like prompting for new auth credentials). Maybe it's better to redirect back to the external URL (provided as GET parameter), from where credentials were entered.

Again, this whole use case looks weird for me. I doubt there is a universal solution.

from traccar-web.

"I don't like the approach to add any UI to the servlet (like prompting for new auth credentials)." Your're right. I didn't mean an UI... just the message.

from traccar-web.

Can't this be closed?

from traccar-web.