In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they somehow revoking cookies from the server side?

  • Why the downvote? – John Jun 19 '13 at 16:28

This is a pretty simple task to accomplish.

Basically the server will store the session IDs of each individual active session in a database somewhere. Revoking a particular session is a simple task of removing the record from the database, which will invalidate the session.

  • Any idea how you'd accomplish this in ASP.NET? – John Jun 19 '13 at 16:09
  • 1
    @John I don't write ASP.NET code so I am unable to comment on a direct implementation. That said, it has nothing to do with which programming language/framework you use. – user10211 Jun 19 '13 at 16:15
  • 1
    Hmm I guess the ASP.NET implementation is probably a question better asked on Stack Overflow. – John Jun 19 '13 at 16:28
  • Are you sure this is correct? This wouldn't scale very well. If you have to validate the user session on every call you would have to make a DB request on every user request which means your DB would have to scale at the same size as your API endpoints scale to handle the one to one load. – Rob Evans May 3 '18 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.