V14: Revoke previous sessions when AllowConcurrentLogins is false

[elit0451]

Details

• Revokes previously issued tokens of a user when Umbraco::CMS::Security::AllowConcurrentLogins is set to false.

Caution

Breaking: This PR adds a new parameter to the RevokeUserAuthenticationTokensNotificationHandler ctor;

Test

• Make sure you are logged out;
• Set Umbraco::CMS::Security::AllowConcurrentLogins to false;
• Login as a user - verify that you can navigate around;
• Open an incognito window;
• Login as the same user;
• In the first browser, verify that you will see a notification about "Session Expired";
• Some changes need to be made on the FE to reflect recent changes on the BE - that's why you are not redirected automatically to the login screen;
• Login again and verify that the same "Session Expired" flow happens again;
• Set config to true - and verify that you can keep several active sessions at the same time.