TOPIC:

For security purposes, I really like the option to see if someone has logged into the admin account from an unrecognised device. Recently, one of my executive used the login from their home on their regular device, but I received a message saying the device was unknown. I think that the executive member is using a wired internet connection rather than a dynamically-allocated IP. Is there a period after which a known device is removed from the recognised list?
Thanks,
Stefan
President & website admin, City Lights (Club #6053)

Is there a period after which a known device is removed from the recognised list?

Not currently.

Here is how this works... Essentially, a cookie named FTH.DeviceUID is created with a unique random text identifier and saved on the device and also is saved in our database. When someone logs in from the device, a check is made for the cookie's existence and to see if it exists in our database. If it exists, then the device is "known" to us.

The only catch with this approach is that cookies can be deleted--this can cause the system to "not know" a device again. If a user deletes their cookies, we are only left with identifying the device by the IP address, which fails if the person is using a dynamic (changing) IP address. If we do match on IP address, then the cookie is re-created and updated in our database.

Thus, we can match on either a device's IP address or the FTH.DeviceUID cookie identifier saved on their device.

Eventually, I am going to have to figure out a way to expire the data for this in our database so that we do not end up with a lot of old, stale, junk records that no longer apply that only serve to make the relevant table huge and db access slow.

Thanks very much for the explanation, and great work.
Cheers,
Stefan