1

In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they somehow revoking cookies from the server side?

Improve this question
1
  • Why the downvote?
    – John
    Commented Jun 19, 2013 at 16:28

1 Answer 1

Reset to default
3

This is a pretty simple task to accomplish.

Basically the server will store the session IDs of each individual active session in a database somewhere. Revoking a particular session is a simple task of removing the record from the database, which will invalidate the session.

Improve this answer
4
  • Any idea how you'd accomplish this in ASP.NET?
    – John
    Commented Jun 19, 2013 at 16:09
  • 1
    @John I don't write ASP.NET code so I am unable to comment on a direct implementation. That said, it has nothing to do with which programming language/framework you use.
    – user10211
    Commented Jun 19, 2013 at 16:15
  • 1
    Hmm I guess the ASP.NET implementation is probably a question better asked on Stack Overflow.
    – John
    Commented Jun 19, 2013 at 16:28
  • 1
    Are you sure this is correct? This wouldn't scale very well. If you have to validate the user session on every call you would have to make a DB request on every user request which means your DB would have to scale at the same size as your API endpoints scale to handle the one to one load.
    – Rob Evans
    Commented May 3, 2018 at 9:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .