[Security Feature Request] User and Authorized Devices logon management

Feature Suggestions
, ,
1

Current Setup:

  1. My plex server is setup on my Synology NAS
  2. I have my own domain
  3. I have a pfsense firewall that manages my traffic through HAProxy to access my plex server. (accessible to the public)

Problem:
Whenever I log in to plex using my domain and credentials, everything works fine. When I close the connection and try to log in again, plex stores my password and login to be selected. I can just click “Sign In” and it will use my credentials. This happens even if I delete the device from the list of authorized devices.

Proposed solution:

  1. If a device is deleted from the list of authorized devices → plex should immediately log this device out. No credential storing, user should be required to pass his login and password to use it further!
  2. If I logout of the account explicit → plex should log me out to the point of needing to provide the login and password!
  3. (further development) More User + Device relations should be added to access management.

Current setup is highly unsecure and blocks completely the option to use a custom domain to be used publicly because even if I log out on some public machine, a different person can just come in and use my account and I cannot even block him out!
This should technically be called a bug of a security concern

2

That’s the browser’s auto-complete/password management feature doing that, not Plex. When you sign out, Plex does invalidate your credentials so you have to sign back in. The browser remembering your credentials is a different issue and you need to change the browser to stop doing that.

3

To be clear, I’m talking about this box in Chrome as an example.

image
image597×837 74.2 KB