~~~ Please read before posting. ~~~

Important: We need your Club Number at a minimum, and as many details as possible.
For further info please read This page before posting.

duration of device recognition: "admin login from unrecognised device" message

  • scartled
  • scartled's Avatar Topic Author
  • Offline
  • New Member
  • New Member
  • Posts: 2
  • Thanks: 1

duration of device recognition: "admin login from unrecognised device" message

5 years 1 month ago
#80648
For security purposes, I really like the option to see if someone has logged into the admin account from an unrecognised device. Recently, one of my executive used the login from their home on their regular device, but I received a message saying the device was unknown. I think that the executive member is using a wired internet connection rather than a dynamically-allocated IP. Is there a period after which a known device is removed from the recognised list?
Thanks,
Stefan
President & website admin, City Lights (Club #6053)
Stefan Cartledge
President, City Lights (Club #6053); 6053.toastmastersclubs.org
Professor of Astronomy and Physics
The topic has been locked.
  • SteveTheTechie
  • SteveTheTechie's Avatar
  • Offline
  • Administrator
  • Administrator
  • Posts: 11526
  • Thanks: 3050

Re: duration of device recognition: "admin login from unrecognised device" message

5 years 1 month ago - 5 years 1 month ago
#80649
Is there a period after which a known device is removed from the recognised list?
Not currently.

Here is how this works... Essentially, a cookie named FTH.DeviceUID is created with a unique random text identifier and saved on the device and also is saved in our database. When someone logs in from the device, a check is made for the cookie's existence and to see if it exists in our database. If it exists, then the device is "known" to us.

The only catch with this approach is that cookies can be deleted--this can cause the system to "not know" a device again. If a user deletes their cookies, we are only left with identifying the device by the IP address, which fails if the person is using a dynamic (changing) IP address. If we do match on IP address, then the cookie is re-created and updated in our database.

Thus, we can match on either a device's IP address or the FTH.DeviceUID cookie identifier saved on their device.

Eventually, I am going to have to figure out a way to expire the data for this in our database so that we do not end up with a lot of old, stale, junk records that no longer apply that only serve to make the relevant table huge and db access slow.
Last edit: 5 years 1 month ago by SteveTheTechie.
The topic has been locked.
  • scartled
  • scartled's Avatar Topic Author
  • Offline
  • New Member
  • New Member
  • Posts: 2
  • Thanks: 1

Re: duration of device recognition: "admin login from unrecognised device" message

5 years 1 month ago
#80653
Thanks very much for the explanation, and great work.
Cheers,
Stefan
Stefan Cartledge
President, City Lights (Club #6053); 6053.toastmastersclubs.org
Professor of Astronomy and Physics
The following user(s) said Thank You: SteveTheTechie
The topic has been locked.
Moderators: BrianJane AtkinsonPamrhtaylor3marc33NotLiablejgavinLcala305peterb323
Time to create page: 0.275 seconds