REST API logout not taking an effect
Hello everyone! I am trying to trigger building the datamodel from Apache Airflow. I am following this path to do so:
- I use GET `api/v1/authentication/login` endpoint to generate an access token
- I use POST `api/v2/builds` endpoint to schedule a new build
- I use GET `api/v2/builds/<datamodelId>` endpoint to check the build status
- I use GET `api/v1/authentication/logout_all` endpoint to log out all the tokens generated for this service account.
The logout step returns status code 204 and no body. The problem is that the access token generated in step 1 is still valid and I can use it to schedule new build. This is big security threat.
Have anyone met sth similar? How to solve the issue?
The support team helped to solve the issue. It turned out it is not feasible to disable access tokens with `api/v1/authentication/logout_all` endpoint. Instead the support team suggested turning on the token expiration and letting it expire by themselves. It is the instruction to turn the token expiration:
- Go to Sisense Admin -> Server & Hardware -> System Management -> Configuration
- Click 5 times on the Sisense logo
- Click Base
- Search for Authentication and expand it
- enable authentication.apiTokenExpiration and save the changes
Thanks for help!
