Unlink push from the account at sign-out

Risk if broken

Data leaked or lost

Applies when

The project has user accounts.

How to do it

Store the session ID next to each subscription or token row. On sign-out, delete those rows on the server, and in the browser call PushSubscription.unsubscribe(). Do the same when another device or an admin ends the session, as Let people sign out of one device or all of them describes. On the next sign-in, the app subscribes again for the new account. A shared tablet or a sold phone otherwise keeps showing order and message alerts for an account nobody is signed in to.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

JavaScript example

export async function signOut() {
  const registration = await navigator.serviceWorker.ready;
  const subscription = await registration.pushManager.getSubscription();
  await fetch('/session', { method: 'DELETE' }); // the server deletes push rows for this session
  await subscription?.unsubscribe();
  location.assign('/signed-out');
}

Python example

@app.delete("/session")
@login_required
def sign_out():
    session_id = current_session.id
    db.push_subscriptions.delete_where(session_id=session_id)
    db.device_tokens.delete_where(session_id=session_id)
    db.sessions.delete(session_id)
    return "", 204

How to check

Sign in as user A in a test browser and turn on push. Sign out, sign in as user B, and send a notification to A. The push service gets no request for that endpoint, and no row links A to it.

Sources

• W3C Push API, PushSubscription unsubscribe method

Related rules

• Let people sign out of one device or all of them in Accounts
• Let organisation owners sign a member out in Accounts