5 ms·

For users, I like to have a secret key per user and put something signed with this key in a cookie to represent the session. Then "log out everywhere" is as sim

For users, I like to have a secret key per user and put something signed with this key in a cookie to represent the session. Then "log out everywhere" is as simple as regenerating their secret key. No need to have to persist state for each session, which is nice.

barrkel 5y ago
Where is the secret key stored? This may not be per session but it is per user, which for most apps is almost the same thing.
- whateveracct 5y ago
  It's per-user. Just a column with all their other stuff. Sessions:Users are Many:1 typically so that's not as simple
  - tatersolid 5y ago
    So you have todo a DB call to get this key on every page load or API request? You’re back to square one. Just use an opaque random session ID
    - whateveracct 5y ago
      I do those anyways - from my user table. But I don't have some extra table of sessions that is append-only (modulo expiration). Cuts out an entire system.