Hi
I wanted to bring inform to I've been encountering the issue with Traccar, and I've confirmed it happens both on the official demo server and on a clean self-hosted instance.
When I log in to the API using one account (e.g., ABC with 1 device), and then log in to the web UI from the same browser or machine using a different account (e.g., XYZ with 0 devices), the session seems to overlap. The web interface still shows the device from the first account (ABC), even though the second account (XYZ) has none.
It looks like the session created via API is not being invalidated or isolated properly when logging in through the web interface, which causes unexpected cross-account data to appear.
Could you please confirm if this is expected behavior or a bug? I'd really appreciate your input or guidance on how to properly separate API and UI sessions if that’s the intended design.
Thanks for your time and for all your great work on Traccar!
Best regards,
Ashok Chandra
To me it sounds like you're only logged in from one account (ABC).
No No I have checked multiple time the issue is exit old session created from /api in web not clearing when doing login from web using different account. Please check with your side
You have to provide enough evidence before I will check something like this.
- Are you sure you're using the latest official release without any code modifications?
- Provide evidence that this is happening. Things like Chrome network logs or something similar.
- Any other relevant details, like custom configuration.
That's likely your browser issue. Because you used explicit auth for the API request, the browser probably saved it and re-uses the same auth for any new requests.
I have re checked with other browser chrome edge, firefox the same issue is showing. Can you check with your side.
What do you want me to check? That's just how browsers work.
Hi
I wanted to bring inform to I've been encountering the issue with Traccar, and I've confirmed it happens both on the official demo server and on a clean self-hosted instance.
When I log in to the API using one account (e.g., ABC with 1 device), and then log in to the web UI from the same browser or machine using a different account (e.g., XYZ with 0 devices), the session seems to overlap. The web interface still shows the device from the first account (ABC), even though the second account (XYZ) has none.
It looks like the session created via API is not being invalidated or isolated properly when logging in through the web interface, which causes unexpected cross-account data to appear.
Could you please confirm if this is expected behavior or a bug? I'd really appreciate your input or guidance on how to properly separate API and UI sessions if that’s the intended design.
Thanks for your time and for all your great work on Traccar!
Best regards,
Ashok Chandra