# Stolen session token (possible in nextcloud)

**URL:** <https://help.nextcloud.com/t/stolen-session-token-possible-in-nextcloud/159112>\
**Category:** ℹ️ Support\
**Tags:** security\
**Created:** [May 31, 2023, 10:00pm UTC](https://help.nextcloud.com/t/stolen-session-token-possible-in-nextcloud/159112 "2023-05-31T22:00:00Z")\
**Posts on this page:** 1\
**Showing post:** 39

<div class="post-metadata">

**Author:** ![ernolf](https://help.nextcloud.com/user_avatar/help.nextcloud.com/ernolf/32/77874_2.png) [@ernolf](https://help.nextcloud.com/u/ernolf)\
**Post date:** [August 2, 2023, 6:47am UTC](https://help.nextcloud.com/t/stolen-session-token-possible-in-nextcloud/159112/39 "2023-08-02T06:47:46Z")

</div>

> [@Aukfood85](#):
>
> how to see users who are connected with mobile (androis, ios) application ?

This script was intended to only show session-cookies that are still alive.  
You can see all registred logins when you change the querry a little bit.  
I have changed the script so that you can choose on startup if you only want to see the logins with session cookies or all registred logins.  
When they are listed, does not mean, that those users are realy loged in. Therefore it is ordered by last activity.

~~Update it with this command:~~

[Edit]: .. new home of the _`nc-who`_ script is here:

> [@Script "nc-who" - similar to unix \`who\`, follow live who is logged in](https://help.nextcloud.com/t/script-nc-who-similar-to-unix-who-follow-live-who-is-logged-in/164972):
>
> Have you ever wanted to check who’s online right now, if there’s any suspicious movement happening on your cloud? Similar to [unix who](https://en.wikipedia.org/wiki/Who_(Unix)), follow live who is logged in with → nc-who ← I have completely reworked this script, which was originally created [here](https://help.nextcloud.com/t/stolen-session-token-possible-in-nextcloud/159112/37) It has a completely revised output. Since it updates at an adjustable refresh rate with [watch](https://en.wikipedia.org/wiki/Watch_(command)), the formatted output from mysql was no longer usable. The solution was to output as html and back with html2text and sed in a usable, nice a…

* * *

> [@Aukfood85](#):
>
> And after it’s possible to remove sessions for thoses users ?

you should do that in the mysql console yourself on your own risk.  
If you are not that good in SQL-commandline, than you can do it in phpMyAdmin and delete the sessions you want to delete from there.

---

_[View the full topic](https://help.nextcloud.com/t/stolen-session-token-possible-in-nextcloud/159112)._