nextcloud/server

Ask for authentication before removing 'Device & Sessions'

Open

#39,390 opened on Jul 14, 2023

View on GitHub
 (2 comments) (0 reactions) (0 assignees)PHP (34,953 stars) (4,865 forks)batch import
0. Needs triageenhancementfeature: authenticationfeature: settingsgood first issue

Description

Describe the solution you'd like As user I want to make sure that when I remove a device or session from my NextCloud account I'm prompted to authenticate with my password So that if my account is compromised no one can remove access without the original password

Additional context I think this feature could help prevent users that leave their account open in a shared device from other users de-authenticating them from their devices and therefore loosing access.

Contributor guide

Tech stack
php
Domain
securityauthentication
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Nextcloud server basicsPHPAuthentication flow
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60
Research direction
This issue requests adding a password confirmation step before removing devices or sessions. The implementation should modify the controller handling the removal to check the user's password. Look for existing password confirmation patterns in the server, such as during account deletion or sensitive settings changes. Files likely involved: lib/private/Authentication/ or apps/settings/lib/Controller/. Read comments on the issue for any additional context.