These recommendations are from @jlfranklin:
I think we should start by adding a way to explicitly expire other sessions, with permissions for admins to expire a single user's sessions and for a user to expire their own. if there is a contirb module that already adds a "logout other devices" buttons, we should consider pulling it into core. If not, it's a simple enough thing to write.
I don't think the right thing to do is to simply delete all sessions on password save. There should be some more administrator control over this. As a starting point, I'll propose this:
- Add a setting to the user or system modules (user.expire_sessions_on_password_change or similar), defaulting to TRUE.
- Add code to conditionally expire sessions on password change.
- Add an "Advanced Security" module that exposes the setting with a description detailing the risk.
- The "Logout other devices" button could be added to the Advanced Security module, too.
Recent comments
Rather than the tricky route, I went for MVP; Now what I'd like to understand, is how to make these Statuses available as a Field and thereby within Views? They are being saved...
Form building question
And if I implement things in this manner, is there a parent-child ajaxian form demonstration (ala taxonomy creation)? Not sure exactly what you have in mind, but all layout settings forms are...
Form building question
@onyx. We have config_clear() that should do what you are after.
Form building question