Disabling a user does not disconnect their open LiveViews #36

New issue

Open

opened 2026-10-18 17:16:52 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 17:16:52 +00:00

Owner

Found by Nye while reviewing #34 (follow-up to #10).

Disabling a user deletes their session tokens, so new requests are refused, but LiveViews they already have open stay connected. log_in_user never puts :live_socket_id in the session, so the disconnect broadcast in user_auth.ex (around line 52) never fires.

Fix: put_session(:live_socket_id, "users_sessions:#{Base.url_encode64(token)}") at login, and when an admin disables a user, broadcast "disconnect" on that topic for each session token deleted.

Found by Nye while reviewing #34 (follow-up to #10). Disabling a user deletes their session tokens, so new requests are refused, but LiveViews they already have open stay connected. `log_in_user` never puts `:live_socket_id` in the session, so the disconnect broadcast in `user_auth.ex` (around line 52) never fires. **Fix:** `put_session(:live_socket_id, "users_sessions:#{Base.url_encode64(token)}")` at login, and when an admin disables a user, broadcast `"disconnect"` on that topic for each session token deleted.

jfro added the

low

main

security

labels

2026-10-18 17:16:52 +00:00