Killing Active Sessions Instantly: A Guide to Secure Logouts and Password Resets

In modern web security, "logging out" isn't just about deleting a cookie on the user's browser. If an attacker has hijacked a session token or if a user’s password was compromised, you must ensure that every single active session across all devices is invalidated immediately.

This blog explores the best strategies for implementing instant, global session revocation.

1. The Strategy: Stateful vs. Stateless

The method you choose depends on how you manage sessions.

A. Stateful Sessions (Server-Side Store)

If you store session data in a database or an in-memory store like Redis, killing sessions is straightforward.
* How it works: When a user logs out or resets their password, you execute a single command to delete all keys associated with that user_id.
* The Result: The next time any device tries to use an old session ID, the server won't find it in the store and will reject the request instantly.

B. Stateless Sessions (JWTs)

JSON Web Tokens (JWTs) are harder to "kill" because they are self-contained and valid until they expire.
* The Problem: Even if you "log out" locally, the token remains valid in the wild.
* The Fix (The Denylist): Store revoked token IDs (jti) in a fast cache (Redis). On every request, check if the token is on the denylist.
* The Better Fix (Security Versioning): Add a security_version or password_epoch to your user database and include it in the JWT payload. If a user resets their password, increment this version in the DB. If the version in the JWT doesn't match the DB, the session is dead.

2. Implementation: The "Session Version" Pattern

One of the most efficient ways to handle mass invalidation—especially for password resets—is the Password Epoch or Session Version pattern.

Step 1: Update the User Schema

Add a field to your user table called session_version (an integer).

Step 2: Include Version in the Session/Token

When a user logs in, include the current session_version in their session data or JWT payload.

Step 3: The Invalidation Trigger

When a user clicks "Log out of all devices" or resets their password:
```sql
UPDATE users SET session_version = session_version + 1 WHERE id = 'user_123';