Pow: Add :last_login_at and :last_login_ip to User struct.

[jung-hunsoo]

Both :last_login_at and :last_login_ip attributes are useful when providing basic security protection.

Maybe :updated_at can be used in replace for :last_login_at though not proper. (for example, when user changed name or password).

[danschultzer]

I never really liked that way for handling security. It only makes sense if you permit only one active session at a time. Also recording only the IP isn't all that useful.

In Pow all active sessions can be found in the credentials store, by calling Pow.Store.CredentialsCache.sessions/3. By default it only records the session id, but you could add in user agent, ip, etc. With Phoenix 1.4 it was shown how telemetry can be enabled easily, and I think that's the way Pow should live update a lot of this stuff. I believe that Pow should ping whenever a session event occurs, and an extension or custom module can pick up and decide how to log it.

I've an idea for a security heavy extension for Pow that persistently store all login history, and has a page for users to see current and past login with user agent and location (IP). The user can also remove active sessions.

I've mostly followed recommendations by the OWASP organization, and I would like to implement their recommendations for logging session lifecycle.

[jung-hunsoo]

Thanks. I'll take a look sessions/3.

There are currently a few suspect visitors to my very young website. (I cannot write detail here.) I'm checking nginx access log often.

Early in this month, my another website running on wordpress underwent a poor attack; js injection. I have the same opinion that pow will be great if it provides more than a better security protection.

Your security extension idea is anticipated. I'll try it when ready.

[humancopy]

@jung-hunsoo For now you can use this as a quick and simple tracking solution: https://github.com/humancopy/pow_last_login