docs(app): 標注「401 不註銷 device token」留下的洞已由後端補上（dispatch #65） - #84
Merged
Conversation
第十一輪決定 session 失效時不呼叫註銷（那支 API 只會再回一次 401）—— 這讓舊使用者的 token 列留在後端，而 FCM token 換人登入時不會變， 結果是前一位的行程通知與對話內容預覽會送到下一位的手機。 後端已改成「一支 token 只能有一位主人」，App 這端維持不變仍然安全； 在原決定旁邊標注清楚，免得下次有人以為那個決定是無代價的。 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
第十一輪定下「session 失效（401）不可去註銷」（那支 API 只會再回一次 401）——
這個決定是對的，但它留下一個代價：舊使用者的 token 列會留在後端。
而 FCM token 是「這台裝置上的這個 App」的識別，換人登入時不會變，於是：
後端已於 2026-07-30 改成「一支 token 只能有一位主人」
（dispatch PR #65，註冊時搬走別人身上的同一支），
App 這端維持不變仍然是安全的。
本 PR 只在原決定旁邊標注清楚，免得下次有人以為那個決定是無代價的。
🤖 Generated with Claude Code