Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

improve alternative token docs section #397

Merged
merged 1 commit into from Jul 6, 2018
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
18 changes: 9 additions & 9 deletions docs/index.rst
Expand Up @@ -305,22 +305,22 @@ Alternative Tokens
==================
Using the user ID as the value of the remember token means you must change the
user's ID to invalidate their login sessions. One way to improve this is to use
an alternative session token instead of the user's ID. For example::
an alternative user id instead of the user's ID. For example::

@login_manager.user_loader
def load_user(session_token):
return User.query.filter_by(session_token=session_token).first()
def load_user(user_id):
return User.query.filter_by(alternative_id=user_id).first()

Then the `~UserMixin.get_id` method of your User class would return the session
token instead of the user's ID::
Then the `~UserMixin.get_id` method of your User class would return the
alternative id instead of the user's primary ID::

def get_id(self):
return unicode(self.session_token)
return unicode(self.alternative_id)

This way you are free to change the user's session token to a new randomly
This way you are free to change the user's alternative id to a new randomly
generated value when the user changes their password, which would ensure their
old authentication sessions will cease to be valid. Note that the session
token must still uniquely identify the user... think of it as a second user ID.
old authentication sessions will cease to be valid. Note that the alternative
id must still uniquely identify the user... think of it as a second user ID.


Fresh Logins
Expand Down