{"action":"created","issue":{"url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/199","labels_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/199/labels{/name}","comments_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/199/comments","events_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/199/events","html_url":"https://github.com/gonzalo-bulnes/simple_token_authentication/issues/199","id":116545390,"number":199,"title":"Question: how to expire the token after a successful sign in ?","user":{"login":"feliperaul","id":743879,"avatar_url":"https://avatars.githubusercontent.com/u/743879?v=3","gravatar_id":"","url":"https://api.github.com/users/feliperaul","html_url":"https://github.com/feliperaul","followers_url":"https://api.github.com/users/feliperaul/followers","following_url":"https://api.github.com/users/feliperaul/following{/other_user}","gists_url":"https://api.github.com/users/feliperaul/gists{/gist_id}","starred_url":"https://api.github.com/users/feliperaul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/feliperaul/subscriptions","organizations_url":"https://api.github.com/users/feliperaul/orgs","repos_url":"https://api.github.com/users/feliperaul/repos","events_url":"https://api.github.com/users/feliperaul/events{/privacy}","received_events_url":"https://api.github.com/users/feliperaul/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-12T13:04:52Z","updated_at":"2015-11-12T14:34:22Z","closed_at":null,"body":"Hi everyone\r\n\r\n@gonzalo-bulnes, first of all, this gem is amazing :)\r\n\r\nMy use case requires setting ```  # config.sign_in_token``` to ```true```, but I wish that after a successful sign in, the token changed, rendering the old one invalid. Maybe this could be set as a new option in the config ?\r\n\r\nHere is the use case: I want to send the user a transactional email inviting them to do some action in my app. When they click the link in that e-mail, they are signed in automatically and session is persisted (they are kept signed in until they log out). But after this click in the e-mail link, I want the token to expire, so if the user clicks again on the same email link, it will ask for credentials (if he's logged out of course). \r\n\r\nHow do I flag this as a question and not an issue ?\r\n"},"comment":{"url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/comments/156117137","html_url":"https://github.com/gonzalo-bulnes/simple_token_authentication/issues/199#issuecomment-156117137","issue_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/199","id":156117137,"user":{"login":"gonzalo-bulnes","id":1619067,"avatar_url":"https://avatars.githubusercontent.com/u/1619067?v=3","gravatar_id":"","url":"https://api.github.com/users/gonzalo-bulnes","html_url":"https://github.com/gonzalo-bulnes","followers_url":"https://api.github.com/users/gonzalo-bulnes/followers","following_url":"https://api.github.com/users/gonzalo-bulnes/following{/other_user}","gists_url":"https://api.github.com/users/gonzalo-bulnes/gists{/gist_id}","starred_url":"https://api.github.com/users/gonzalo-bulnes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gonzalo-bulnes/subscriptions","organizations_url":"https://api.github.com/users/gonzalo-bulnes/orgs","repos_url":"https://api.github.com/users/gonzalo-bulnes/repos","events_url":"https://api.github.com/users/gonzalo-bulnes/events{/privacy}","received_events_url":"https://api.github.com/users/gonzalo-bulnes/received_events","type":"User","site_admin":false},"created_at":"2015-11-12T14:34:22Z","updated_at":"2015-11-12T14:34:22Z","body":"Hi @feliperaul,\r\n\r\nIn your **sign in** action, just [reset the user's authentication token][doc] and the link won't sign her in anymore. Because your session was persisted, your user will still be signed in until she signs out,  and the will still take her to the correct page.\r\n\r\n  [doc]: https://github.com/gonzalo-bulnes/simple_token_authentication#tokens-generation\r\n\r\nBuilding on the same scenario we defined in #163:\r\n\r\n```ruby\r\n# config/initializers/simple_token_authentication.rb\r\n\r\nSimpleTokenAuthentication.configure do |config|\r\n\r\n  # Configure the session persistence policy after a successful sign in.\r\n  config.sign_in_token = true\r\n\r\nend\r\n```\r\n\r\n```ruby\r\n# app/models/user.rb\r\n\r\nclass User < ActiveModel\r\n  acts_as_token_authenticatable\r\n\r\n  # Invalidate the user's authentication token and set a new one\r\n  #\r\n  # user - a token authenticatable User\r\n  #\r\n  # Returns the user's new authentication token\r\n  def reset_authentication_token!\r\n      authentication_token = nil\r\n      save # automatically generates a new authentication token\r\n      authentication_token \r\n  end\r\n\r\n  # ...\r\n\r\nend\r\n```\r\n\r\n```ruby\r\n# app/controllers/susbscriptions_controller.rb\r\n\r\nclass SubscriptionsController < ActionController\r\n\r\n  # the first time users' credential are present and correct they will get signed in\r\n  acts_as_token_authentication_handler_for User\r\n\r\n  def renew\r\n    # do whatever you need to renew the user's subscrption\r\n    current_user.reset_authentication_token!\r\n    # then build the response as usual\r\n\r\n    # ...\r\n  end\r\n\r\n  # ...\r\n\r\nend\r\n```\r\n\r\nDo not worry about issues being issues or issues being questions or whatever. Issues are meant to communicate and they just appear to have a scary name. Please open as many as you need to keep topics distinct, I'll take care of labelling them so they're easy to find. ; )"}}