Session overview
Review active and inactive sessions, login and last-active times, device details, IP address, and available location data.
Features
The plugin tracks logins and session activity and provides controls in the Strapi admin.
Session controls
Admins with plugin access can terminate sessions, end a user's sessions, block or unblock a user, and clean up inactive records. Older records can be removed according to the retention setting.
Account security
Session validation integrates with Users & Permissions JWT handling. Optional settings cover geofencing, security scoring, email alerts, and Discord or Slack webhooks.
Multiple sessions per user
Authenticated users can inspect and end their own sessions. Session queries are scoped to the authenticated account.
Install
Install the published package, enable the plugin, then rebuild the Strapi admin.
Terminal
npm install strapi-plugin-magic-sessionmanagerconfig/plugins.ts
export default () => ({
'magic-sessionmanager': {
enabled: true,
},
});Terminal
npm run build
npm run developAfter startup, open the Strapi admin and select Sessions in the plugin navigation.
Configuration
Enable the plugin in config/plugins.ts. Plugin settings can also be managed in the admin settings page.
Optional Strapi configuration
export default () => ({
'magic-sessionmanager': {
enabled: true,
config: {
lastSeenRateLimit: 30000,
inactivityTimeout: 900000,
geoIpProvider: 'local-mmdb',
geoIpDatabasePath: process.env.MAGIC_SESSIONMANAGER_GEOIP_DATABASE,
},
},
});lastSeenRateLimit and inactivityTimeout are milliseconds. For local GeoIP data, configure a MaxMind-compatible database path. GeoIP, geofencing, alerts, and webhooks are optional.
Security and permissions
Production requirement: set
SESSION_ENCRYPTION_KEY before starting Strapi in production. The plugin fails startup when it is missing.Admin API
Admin routes require an authenticated Strapi admin and the plugin::magic-sessionmanager.access permission. Grant that permission through Strapi admin roles.
Content API
Content API routes require Users & Permissions authentication and are rate-limited. Session reads and termination are restricted to the authenticated user's own sessions.
Stored tokens
Session tokens are encrypted at rest with AES-256-GCM. The encryption key must remain stable because changing it prevents existing encrypted tokens from being decrypted.
GeoIP credentials
MaxMind credentials entered in the admin are stored in the Strapi plugin store. The license key is not returned to the browser after saving.
Use the repository README for detailed GeoIP setup and configuration options. Do not expose secrets in client-side code or commit them to source control.
API
Content API routes are prefixed with /api/magic-sessionmanager and require a Users & Permissions JWT. Admin routes use the Strapi admin API and require the plugin access permission.
| Method | Path | Access |
|---|---|---|
| GET | /my-sessions | Authenticated user, own sessions |
| GET | /current-session | Authenticated user, current session |
| POST | /logout | Authenticated user, current session |
| POST | /logout-all | Authenticated user, all own sessions |
| POST | /logout-others | Authenticated user, other own sessions |
| DELETE | /my-sessions/:sessionId | Authenticated user, own session |
| GET | /sessions | Admin with plugin access |
| GET | /sessions/active | Admin with plugin access |
| POST | /sessions/:sessionId/terminate | Admin with plugin access |
| PUT | /settings | Admin with plugin access |
See the README for request examples and the full route set, including GeoIP and settings routes.
Releases and testing
The project uses Conventional Commits and semantic-release on Node.js 22. Releases run tests, the production build, and package verification before publishing to npm with GitHub OIDC.
Before the first release, configure npm Trusted Publishing for Schero94/Magic-Sessionmanager and the release.yml workflow. No long-lived npm write token is used.
Local checks
npm ci --legacy-peer-deps
npm test
npm run build
npm run verify