Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-66776

Send notifications when new devices are used to log in into the site

    XMLWordPrintable

Details

    • MOODLE_37_STABLE, MOODLE_400_STABLE
    • MOODLE_400_STABLE
    • MDL-66776-master
    • Hide
      Prerequisite
      1. MailHog or similar tool to capture emails coming out from Moodle
      2. The Moodle mobile app installed
      3. Tests should be performed using the Chrome or Firefox incognito mode (instructions are for Chrome)
      Test notifications are not sent when using the same browser and changing IP
      1. Open a new browser in incognito mode (do not close it until the end of this test)
      2. Login to the Moodle site
      3. Logout but keep the incognito browser open
      4. Set a false IP for the user you just used: UPDATE `mdl_user` SET `lastip` = '1:2:3:4:5:6:7:1' WHERE `mdl_user`.`id` = YOUR_USER_ID;
      5. Login again in the same incognito browser
      6. Inspect your database, table mdl_task_adhoc and confirm that:
        • The table is empty (there are not notification tasks scheduled)
          # Close the browser
      Test notifications are not sent when using same IP but a different browser
      1. Open a new browser in incognito mode
      2. Login to the Moodle site
      3. Logout
      4. Remove the MoodleSession cookie (using the browser developer tools -> Application -> Cookies) and close the incognito browser instance
      5. Open again a browser instance in incognito mode
      6. Login again
      7. Inspect your database, table mdl_task_adhoc and confirm that:
        • The table is empty (there are not notification tasks scheduled)
          # Close the browser
      Test notifications are sent when using a new browser and different IP
      1. Open a new browser in incognito mode
      2. Login to the Moodle site
      3. Logout
      4. Set a false IP for the user you just used: UPDATE `mdl_user` SET `lastip` = '1:2:3:4:5:6:7:1' WHERE `mdl_user`.`id` = YOUR_USER_ID;
      5. Remove the MoodleSession cookie and close the browser instance
      6. Open again the browser in incognito mode
      7. Login again
      8. Inspect your database, table mdl_task_adhoc and confirm that:
        • The table is NO empty
          #* There is an scheduled task: \core\task\send_login_notifications
      9. Open a terminal and run the Moodle site cron (php admin/cli/cron.php)
      10. Confirm that:
        • The student has received an email via MailHog indicating that there is a new sign in into your site account

      Please note that before performing these tests, you need to check that you are assigned the same public IP in all your devices (computer and phone)

      Mobile: Notification sent new device and different IP

      # Fresh install the Moodle app on a mobile device
      # Login to the Moodle site

      1. Inspect your database, table mdl_task_adhoc and confirm that:
        • The table is NO empty
          #* There is an scheduled task: \core\task\send_login_notifications
      2. Wait two minutes (because the ad-hoc task is scheduled)
      3. Open a terminal and run the Moodle site cron (php admin/cli/cron.php)
      4. Confirm that:
        • The student has received an email via MailHog indicating that there is a new sign in into your site account including an UserAgent that is the same you can check in the Mobile app settings -> About -> Device info -> Navigator userAgent
      5. Inspect your database again, reload the contents of table mdl_task_adhoc and confirm that:
        • The table is empty
      Mobile: Notification not sent in new login
      1. Click the option "Change site" in the more menu in the mobile app (three vertical lines) to quit the site
        # Login to the Moodle site again using the + icon at the bottom right (you will be asked again to enter your site URL username and password)
      2. Inspect your database, table mdl_task_adhoc and confirm that:
        • The table is empty
      Mobile: Notification not sent in new login with same device and different IP
      1. Click the option "Change site" in the more menu in the app (three vertical lines) to quit the site
      2. Set a false IP for the user you just used: UPDATE `mdl_user` SET `lastip` = '1:2:3:4:5:6:7:1' WHERE `mdl_user`.`id` = YOUR_USER_ID; OR alternatively connect your phone to a different network so you get a different IP assigned
        # Login to the Moodle site again using the + icon at the bottom right (you will be asked again to enter your site URL username and password)
      3. Inspect your database, table mdl_task_adhoc and confirm that:
        • The table is NOT empty
      4. Wait two minutes (because the ad-hoc task is scheduled)
      5. Open a terminal and run the Moodle site cron (php admin/cli/cron.php)
      6. Confirm that:
        • You don't receive any notification
      7. Inspect your database, table mdl_task_adhoc and confirm that:
        • The table is empty
      Show
      Prerequisite MailHog or similar tool to capture emails coming out from Moodle The Moodle mobile app installed Tests should be performed using the Chrome or Firefox incognito mode (instructions are for Chrome) Test notifications are not sent when using the same browser and changing IP Open a new browser in incognito mode (do not close it until the end of this test) Login to the Moodle site Logout but keep the incognito browser open Set a false IP for the user you just used: UPDATE `mdl_user` SET `lastip` = '1:2:3:4:5:6:7:1' WHERE `mdl_user`.`id` = YOUR_USER_ID; Login again in the same incognito browser Inspect your database, table mdl_task_adhoc and confirm that: The table is empty (there are not notification tasks scheduled) # Close the browser Test notifications are not sent when using same IP but a different browser Open a new browser in incognito mode Login to the Moodle site Logout Remove the MoodleSession cookie (using the browser developer tools -> Application -> Cookies) and close the incognito browser instance Open again a browser instance in incognito mode Login again Inspect your database, table mdl_task_adhoc and confirm that: The table is empty (there are not notification tasks scheduled) # Close the browser Test notifications are sent when using a new browser and different IP Open a new browser in incognito mode Login to the Moodle site Logout Set a false IP for the user you just used: UPDATE `mdl_user` SET `lastip` = '1:2:3:4:5:6:7:1' WHERE `mdl_user`.`id` = YOUR_USER_ID; Remove the MoodleSession cookie and close the browser instance Open again the browser in incognito mode Login again Inspect your database, table mdl_task_adhoc and confirm that: The table is NO empty #* There is an scheduled task: \core\task\send_login_notifications Open a terminal and run the Moodle site cron (php admin/cli/cron.php) Confirm that: The student has received an email via MailHog indicating that there is a new sign in into your site account Please note that before performing these tests, you need to check that you are assigned the same public IP in all your devices (computer and phone) Mobile: Notification sent new device and different IP # Fresh install the Moodle app on a mobile device # Login to the Moodle site Inspect your database, table mdl_task_adhoc and confirm that: The table is NO empty #* There is an scheduled task: \core\task\send_login_notifications Wait two minutes (because the ad-hoc task is scheduled) Open a terminal and run the Moodle site cron (php admin/cli/cron.php) Confirm that: The student has received an email via MailHog indicating that there is a new sign in into your site account including an UserAgent that is the same you can check in the Mobile app settings -> About -> Device info -> Navigator userAgent Inspect your database again, reload the contents of table mdl_task_adhoc and confirm that: The table is empty Mobile: Notification not sent in new login Click the option "Change site" in the more menu in the mobile app (three vertical lines) to quit the site # Login to the Moodle site again using the + icon at the bottom right (you will be asked again to enter your site URL username and password) Inspect your database, table mdl_task_adhoc and confirm that: The table is empty Mobile: Notification not sent in new login with same device and different IP Click the option "Change site" in the more menu in the app (three vertical lines) to quit the site Set a false IP for the user you just used: UPDATE `mdl_user` SET `lastip` = '1:2:3:4:5:6:7:1' WHERE `mdl_user`.`id` = YOUR_USER_ID; OR alternatively connect your phone to a different network so you get a different IP assigned # Login to the Moodle site again using the + icon at the bottom right (you will be asked again to enter your site URL username and password) Inspect your database, table mdl_task_adhoc and confirm that: The table is NOT empty Wait two minutes (because the ad-hoc task is scheduled) Open a terminal and run the Moodle site cron (php admin/cli/cron.php) Confirm that: You don't receive any notification Inspect your database, table mdl_task_adhoc and confirm that: The table is empty

    Description

       

      This issue is about generating notifications (user can always opt-out) about user logins from new devices.

      As you know, this is commonly available on different platforms (Google, Netflix, etc...), it is a really nice security improvement.

      The solution is very simple and it has been developed in a privacy-driven way, using existing data we already have for the user and avoiding fingerprinting our users.

      How can we detect new devices?

      For Moodle LMS (web): When we detect a new MoodleSession cookie is set and the most recent IP is not being used. This happens when the user is using a new browser or when he closed the browser session (restarted the computer for example) and he is connecting from a different IP than the last used to connect to Moodle.

      I've done several tests and this works pretty well, considering that most of the computer uses do not close browsers (they just keep it open and suspend the computer) but even if they restart the computer, we will still check the last IP used (that should not change much unless you are using a mobile device)

      For the Moodle app: This is a bit trickier because we can have users using the standard Moodle app, custom apps or webapps. Apart from that, the token can be valid for several months, so I only check when a new login is done.
      In this case, I first check the IP address (we can't set cookies) and if it has changed then, if the user is using the official Moodle app or a BMA, I check if a new device was added to the table of known devices after login (user_devices), if so, it means it is a new device so only in that case I will send a notification.

      To summarise:
      LMS:
      Existing MoodleSession cookie: Notification not sent
      New MoodleSession cookie, same IP: Notification not sent
      New MoodleSession cookie, different IP: Notification sent

      App:
      New login, same IP: Notification not sent
      New login, different IP but known device: Notification not sent
      New login, different IP and new device: Notification sent

      The implementation is not perfect but is simple, avoid collecting new data (privacy safe) and it works for most cases. Furthermore, the user can always opt-out in his notifications preferences if this is annoying for them. Although, I forsee some organisations making this notification mandatory/forced for security purposes.

      Message could be something like:

       

      New login to your SITENAME account

      _Hi XX,

      we've noticed a new log-in with your MOODLE SITE NAME () account:

      Device: Android
      Location: Barcelona, Spain
      IP:
      Time: 19:20

      If you didn't log-in, please, change your password and select the option "Logout from all my devices" in your Moodle site profile._

      Attachments

        Issue Links

          caused a regression

          Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-73391 Unit test failure in master branch undefined function external_generate_token_for_current_user

          • Minor - Minor loss of function where workaround is possible
          • Closed
          has a non-specific relationship to

          Improvement - An enhancement to an existing Moodle feature. MDL-75342 Login from new IP email improvements

          • Minor - Minor loss of function where workaround is possible
          • Open
          has been marked as being related by

          Improvement - An enhancement to an existing Moodle feature. MDL-73558 Change password URLs and external authentication

          • Minor - Minor loss of function where workaround is possible
          • Open

          Improvement - An enhancement to an existing Moodle feature. MDL-75666 Identify same browser login by cookie instead of by IP

          • Minor - Minor loss of function where workaround is possible
          • Waiting for peer review

          Activity

            People

              jleyva Juan Leyva
              jleyva Juan Leyva
              Pau Ferrer Pau Ferrer
              Andrew Lyons Andrew Lyons
              Gladys Basiana Gladys Basiana
              Adrian Greeve, David Woloszyn, Huong Nguyen, Jake Dallimore, Michael Hawkins, Stevani Andolo
              Votes:
              0 Vote for this issue
              Watchers:
              15 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                19/Apr/22

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 1 week, 1 day, 1 hour, 20 minutes
                  1w 1d 1h 20m