{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-auth-server/issues/988","labels_url":"https://api.github.com/repos/mozilla/fxa-auth-server/issues/988/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-auth-server/issues/988/comments","events_url":"https://api.github.com/repos/mozilla/fxa-auth-server/issues/988/events","html_url":"https://github.com/mozilla/fxa-auth-server/issues/988","id":95592684,"number":988,"title":"Record device metadata on sessionTokens","user":{"login":"rfk","id":34695,"avatar_url":"https://avatars.githubusercontent.com/u/34695?v=3","gravatar_id":"","url":"https://api.github.com/users/rfk","html_url":"https://github.com/rfk","followers_url":"https://api.github.com/users/rfk/followers","following_url":"https://api.github.com/users/rfk/following{/other_user}","gists_url":"https://api.github.com/users/rfk/gists{/gist_id}","starred_url":"https://api.github.com/users/rfk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfk/subscriptions","organizations_url":"https://api.github.com/users/rfk/orgs","repos_url":"https://api.github.com/users/rfk/repos","events_url":"https://api.github.com/users/rfk/events{/privacy}","received_events_url":"https://api.github.com/users/rfk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-17T05:54:36Z","updated_at":"2015-07-17T18:07:58Z","closed_at":null,"body":"In order to provide useful contextual information in our future \"things connected to your account\" dashboard, we will need to associate sessionTokens with the device that owns them.  In #983 I proposed adding some generic activity metadata to every token, but for tokens that belong to a device we should be able to do even more.\r\n\r\nStrawman:  \r\n\r\n* Add `device` and `description` fields to the sessionToken metadata.  Web login sessions can leave `device` blank, while sync login sessions can specify their sync client GUID and maybe their human-readable device name.\r\n* Add a `POST /v1/session/update` endpoint through which devices can update the metadata on their session, e.g. change the description field.\r\n* Revisit #950 to allow listing all your sessions along with the associated metadata.\r\n* Treat the `device` ID as a stable device identifier, which means e.g. if you login with `device=FOO` then we clobber any existing sessionToken for `device=FOO`, we don't send a notification that \"a new device is connected\", etc.\r\n\r\nIn future work, the `device` identifier might become a foreign key into a separate \"device catalog\" service, or a more full-featured devices API on this server itself.  But this seems like a sensible first step for tracking them, and is something we might be able to complete in the Fx42 timeframe.\r\n\r\n@kitcambridge @ckarlof @bbangert thoughts?"},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-auth-server/issues/comments/122361374","html_url":"https://github.com/mozilla/fxa-auth-server/issues/988#issuecomment-122361374","issue_url":"https://api.github.com/repos/mozilla/fxa-auth-server/issues/988","id":122361374,"user":{"login":"kitcambridge","id":243830,"avatar_url":"https://avatars.githubusercontent.com/u/243830?v=3","gravatar_id":"","url":"https://api.github.com/users/kitcambridge","html_url":"https://github.com/kitcambridge","followers_url":"https://api.github.com/users/kitcambridge/followers","following_url":"https://api.github.com/users/kitcambridge/following{/other_user}","gists_url":"https://api.github.com/users/kitcambridge/gists{/gist_id}","starred_url":"https://api.github.com/users/kitcambridge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kitcambridge/subscriptions","organizations_url":"https://api.github.com/users/kitcambridge/orgs","repos_url":"https://api.github.com/users/kitcambridge/repos","events_url":"https://api.github.com/users/kitcambridge/events{/privacy}","received_events_url":"https://api.github.com/users/kitcambridge/received_events","type":"User","site_admin":false},"created_at":"2015-07-17T18:07:58Z","updated_at":"2015-07-17T18:07:58Z","body":":+1: This seems sensible to me! In particular, I think having the auth server issue the device ID simplifies token revocation and remote logout quite a bit.\r\n\r\nI wonder, though, if we could just use the session ID as the device ID. This means it won't be stable if the user signs out of Firefox, then signs back in...but maybe that's not so bad. Otherwise, I think we'd want to persist `(lastAccountId, lastDeviceId)` locally, and make sure we clobber the `lastDeviceId` if the user signs in with a different account."}}