expressjs / expressjs/session

Destroying all sessions for a given user?

Open
#865 18 comments 7 reactions 0 assignees View on GitHub
discuss question
Dominant language
JavaScript
Stars
6.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Hi,

I'm maintaining the express session store for [Prisma](https://www.prisma.io) ([prisma-session-store](https://github.com/kleydon/prisma-session-store/pulls)).

Recently, a developer asked whether there might be a way to destroy _all_ sessions _for a given user_ (as might be desirable when logging out of all devices, changing a password, etc).

While this can be accomplished at the back-end application layer, it requires (I think?) downloading _all_ sessions, and then filtering them, which might not be ideal if there are hundreds or thousands of sessions.

I'm considering adding the ability to destroy all sessions for a given user as a feature specific to the data store that I'm maintaining, but wanted to check in first, to see if something along these lines might be in the cards for the express-session library (and the session store interface it exposes) more generally...

Do you imagine this library would surface this sort of functionality in the future? Or does this seem like the sort of thing that ought to live in each specific session store implementation?

Any advice / recommendations / rationales would be much appreciated.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.