Support force-logout for active sessions

Right now you can only force-logout a remember-me token by using a custom token. It would be nice if there was a clean way to do this for active sessions, too.

From a quick look at the code this could probably be done by making get_id return e.g. a tuple of userid, token and the user_loader handling this token accordingly (retrieving the user from the DB and checking if the tokens match). However, the documentation is quite clear about the user id having to be unicode and a second look at the code shows that the user id actually converted to a string at some point: data = encode_cookie(str(session['user_id'])) (actually, shouldn’t this be unicode and not str?).

Sure, I could use a custom string representation such as id:token but it feels dirty.

[ghost]

I find this is needed, on my situation

1. the user fresh login in current session
2. the user reset the password in another session
3. the user is still login in the current session

really need some way to force that user to reenter the password. cause they already reset there password.right?? and please support…

[philipithomas]

We just implemented this on our end. It was pretty hacky with flask-login, requiring hijacking of the get_id function to incorporate both a user_id and session_id.

Some better separation of id and session_id in flask login would have been really helpful, and set me up to have a callback to validate the session id too.