Let users inspect and revoke browser sessions #19

New issue

Open

opened 2026-11-01 20:11:38 +00:00 by viacheslavshuka · 0 comments

viacheslavshuka commented

2026-11-01 20:11:38 +00:00

Owner

Outcome

Users can remain signed in on several devices and end unwanted Quorum access from their account page.

Acceptance criteria

Concurrent browser sessions remain supported. The account page shows approximate browser/device type and last user activity for the current user's sessions.
Session identifiers exposed for management do not expose authentication cookies or provider credentials.
A user can revoke an individual session or all other sessions. Revocation prevents subsequent protected requests with the revoked cookie.
Revoking all other sessions preserves the current session. Revoking the current session ends its Quorum access.
Another account cannot list or revoke these sessions, including by substituting a session-management identifier.
Expiry and revocation remain authoritative across API workers. Background polling does not count as user activity.
The page explains that these controls affect Quorum sessions, not Telegram's own login sessions.

Validation design

Create several browser sessions for two accounts. Exercise individual revocation, all-other revocation, expiry, and requests through another worker. Assert both the remaining valid sessions and rejected revoked sessions. Try cross-account identifiers to detect object-level authorization failures. Check that session labels remain approximate and contain no raw credentials.

Dependencies

#14: Authenticate Telegram users through protected Quorum sessions. Provides durable browser sessions and authoritative revocation.

## Outcome Users can remain signed in on several devices and end unwanted Quorum access from their account page. ## Acceptance criteria - Concurrent browser sessions remain supported. The account page shows approximate browser/device type and last user activity for the current user's sessions. - Session identifiers exposed for management do not expose authentication cookies or provider credentials. - A user can revoke an individual session or all other sessions. Revocation prevents subsequent protected requests with the revoked cookie. - Revoking all other sessions preserves the current session. Revoking the current session ends its Quorum access. - Another account cannot list or revoke these sessions, including by substituting a session-management identifier. - Expiry and revocation remain authoritative across API workers. Background polling does not count as user activity. - The page explains that these controls affect Quorum sessions, not Telegram's own login sessions. ## Validation design Create several browser sessions for two accounts. Exercise individual revocation, all-other revocation, expiry, and requests through another worker. Assert both the remaining valid sessions and rejected revoked sessions. Try cross-account identifiers to detect object-level authorization failures. Check that session labels remain approximate and contain no raw credentials. ## Dependencies - [#14: Authenticate Telegram users through protected Quorum sessions](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/14). Provides durable browser sessions and authoritative revocation. ## Related work - [#49: Restore account access through moderator-approved Telegram relinking](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/49) - [#25: Preserve unsaved form input during reauthentication](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/25)

viacheslavshuka added the

labels

2026-11-01 20:13:19 +00:00

viacheslavshuka referenced this issue

2026-11-01 20:15:40 +00:00

Authenticate Telegram users through protected Quorum sessions #14

viacheslavshuka added a new dependency