Logout button on shared email-links

[Django-BOfH]

urgently needed option/function

If a cloud user shares a folder or file via email, the recipient receives two messages. The first message contains the link to the source, the other the corresponding password. This allows the recipient to download the data or set up new ones.

But what the external user can't, he can't actively log out of the cloud!

What is definitely missing here is a logout button for the external users, where something was shared via email.

[nextcloud-bot]

GitMate.io thinks possibly related issues are #4334 (Improve sharing email information), #5334 (Merge email and remote sharing), #5658 (share by email - password email not sent - solved), #7469 (Cannot set password for share by email links), and #996 (RC 10 Share File Link by email missing send button ).

[MorrisJobke]

cc @nextcloud/designers @nextcloud/sharing

[jancborchardt]

For a password-protected link, the session should probably be ended (logged out) when the tab is closed. When it's your own laptop you can simply opt to "save password" in the browser, but otherwise the info can be forgotten.

What do you think?

[rullzer]

@jancborchardt we can't detect this (browser close). If the browser saves the cookie it will still work.

Of course the session will die after the session lifetime. Which on most system is something like 22 minutes.

[jancborchardt]

Of course the session will die after the session lifetime. Which on most system is something like 22 minutes.

So are we agreeing that we don’t need a log out function there, and should close this? Or how should we proceed? ;)

[MorrisJobke]

Let's close it then for now.

[Django-BOfH]

OKAY. It's a pity that you have so strongly denied it.

Perhaps let me briefly explain why and how such a function should be the standard feature.

With our Nextcloud installation, for procedural and legal reasons, only in-house employees receive a user account in the cloud.

Therefore, only shared folders can be exchanged with other people. Depending on the level of confidentiality, the link to the cloud and the associated password are shared automatically via email. For more confidential content, only the link is shared and the password is exchanged on a separate communication channel.
External people have already told us several times why it is not possible to actively log off from the Cloud. For example, not everyone automatically deletes cookies when closing the browser. So a third party could get access to the shared content, if this access to the browser with still valid access/password-cookie and that is of course not so great.

What is also missing, of course, and has already been criticized several times, is the fact that external users who only had access to the cloud via a link and password have no way of changing the password sent to them. There should actually be a way for these people to change the password they received in their email inbox and thus protect the shared folder.

So it would be great if external contacts could actively log out and also change their password.

For me personally, it's really quite astonishing why such essential functions are missing in an application that is primarily concerned with secure and confidential communication and data exchange.

[MorrisJobke]

So it would be great if external contacts could actively log out and also change their password.

That is due to the fact, that it's the password of the share and not the password of a user. It's still an interesting request and due to the email share feature it might make sense. Nevertheless the requests for this are quite low. Currently there are no plans to implement such a feature. This does not mean we don't want this feature, but it is simply not on our roadmap for the near future. If somebody wants to implement this feature nevertheless we are happy to assist and help out.

If you wish to have this feature implemented by the Nextcloud GmbH there is the option for consulting work on top of your Nextcloud Enterprise subscription to get your features implemented.