Remove login tokens for meteor auth

Question

I am not sure if this has been asked before but the loginTokens are getting really large and without any cleanup make my database increase in size. What is being done about this? what are others doing to manage this. I am referring to the default Meteor.users.services which has an array of loginTokens that get created every time the user logs in/out

"resume" : {
        "loginTokens" : [
            {
                "token" : "HMntXepqzPBLDGkGX",
                "when" : 1372559065392
            },
            {
                "token" : "uCHqA95HZZyN5tRtH",
                "when" : 1372563545565
            },
            {
                "token" : "sNGZhhATTrTg8582w",
                "when" : 1372622561176
            },
            {
                "token" : "hPWpm4uQQXWrkK6NS",
                "when" : 1372634411432
            },
            {
                "token" : "DFntTEcsKKT6bJ3rx",
                "when" : 1372635411745
            },
            {
                "token" : "BBM3acLQhuNtsHvkn",
                "when" : 1372638979158
            },
            {
                "token" : "EHgLLHMh6JWxKfuoe",
                "when" : 1372825386462
            }
        ]
    }

score 3 · Answer 1 · answered Jul 04 '13 at 16:22

This has been referenced several times on the Meteor google group but it's not a high-priority issue. In my authentication system, I delete tokens more than a day old whenever a user logs in. This ensures that the tokens don't expire if they haven't managed to log in for a while.

Accounts.registerLoginHandler (loginRequest) ->

  # ... Do whatever you need to do to authenticate the user

  stampedToken = Accounts._generateStampedLoginToken();
  Meteor.users.update userId,
    $push: {'services.resume.loginTokens': stampedToken}

  # Delete old resume tokens so they don't clog up the db
  cutoff = +(new Date) - (24*60*60)*1000
  Meteor.users.update userId, {
    $pull:
      'services.resume.loginTokens':
        when: {$lt: cutoff}
  },
  {multi : true}

  return {
    id: userId,
    token: stampedToken.token
  }

are you overriding the `registerLoginHandler` method in this file https://github.com/meteor/meteor/blob/master/packages/accounts-base/accounts_server.js///? If so when/where are you doing this (Meteor.startup client/server ) — Warz, Jul 04 '13 at 17:36
No, I'm not overriding it, I'm calling it. (This is coffeescript, try http://js2coffee.org to see the equivalent Javascript.) The code snippet above defines a new login handler, so you can pull it into whatever authentication system you are using. — Andrew Mao, Jul 05 '13 at 18:31

score 2 · Answer 2 · answered Jul 07 '13 at 20:19

2

FYI, I did file an issue on this and there is a pending pull request that fixes it:

https://github.com/meteor/meteor/issues/891

answered Jul 07 '13 at 20:19

kenyee

2,309
1
24
32

score 0 · Answer 3 · edited Dec 30 '20 at 21:16

I use Meteor with Vue and I fixed it of the following way:

Accounts.validateLoginAttempt((loginAttempt) => {
if (loginAttempt.allowed && loginAttempt.user.services.resume?.loginTokens?.length > 0) {
    const loginTokensOfUser = loginAttempt.user.services.resume.loginTokens;
        Meteor.users.update(loginAttempt.user._id, {
            $set: {
              'services.resume.loginTokens': [loginTokensOfUser.pop()]
            }
        });
    return true;
}
});

This code must be in the server side. Tested in: Meteor 1.10.2 Vue 2.6.11

Remove login tokens for meteor auth

3 Answers3

Linked