summaryrefslogtreecommitdiff
path: root/doc/user/profile/active_sessions.md
diff options
context:
space:
mode:
authorImre Farkas <ifarkas@gitlab.com>2019-02-25 14:52:40 +0100
committerImre Farkas <ifarkas@gitlab.com>2019-02-27 11:45:27 +0100
commit038d530565bc64729706bbd9afad275699be459d (patch)
tree7cb6741e2490a943a8e3dc1e61011bc7e56385ae /doc/user/profile/active_sessions.md
parent44c4aad983570ea1832aa08c39f46dbc1b475fd3 (diff)
downloadgitlab-ce-038d530565bc64729706bbd9afad275699be459d.tar.gz
Remove ability to revoke active session
Session ID is used as a parameter for the revoke session endpoint but it should never be included in the HTML as an attacker could obtain it via XSS.
Diffstat (limited to 'doc/user/profile/active_sessions.md')
-rw-r--r--doc/user/profile/active_sessions.md8
1 files changed, 1 insertions, 7 deletions
diff --git a/doc/user/profile/active_sessions.md b/doc/user/profile/active_sessions.md
index 5119c0e30d0..28e3f4904a9 100644
--- a/doc/user/profile/active_sessions.md
+++ b/doc/user/profile/active_sessions.md
@@ -4,7 +4,7 @@
> in GitLab 10.8.
GitLab lists all devices that have logged into your account. This allows you to
-review the sessions and revoke any of it that you don't recognize.
+review the sessions.
## Listing all active sessions
@@ -12,9 +12,3 @@ review the sessions and revoke any of it that you don't recognize.
1. Navigate to the **Active Sessions** tab.
![Active sessions list](img/active_sessions_list.png)
-
-## Revoking a session
-
-1. Navigate to your [profile's](#profile-settings) **Settings > Active Sessions**.
-1. Click on **Revoke** besides a session. The current session cannot be
- revoked, as this would sign you out of GitLab.