With some platforms, like LinkedIn, you can see a list of all sessions where you are logged in, and you can even log them out on a distance.

enter image description here

How would you implement something like that? I'm not talking about specific code, but more about general flow.

I am using ASP.NET myself, but I think a general approach would be more useful for others.

Right now I'm thinking about something like this:

  • User logs in, validate email/password combination
  • Generate GUID, save to database together with UserId and Browser information.
  • Put Cookie in a serverside-read-only cookie.
  • When user wants to sign out from a distance, we remove the GUID in the database.

One of the security issues here would be that the GUID can get intercepted, and an attacker could use this to login.

So how to do this properly?

  • Yup, that's how you do it. You're probably doing everything except the last step already, since you've got to have some kind of server-side persistence to have sessions across HTTP requests at all. Commented Dec 28, 2014 at 16:02

1 Answer 1


Every session is going to have some authorization artifact it uses to track sessions. (In web applications, usually this is a token in a cookie, although it doesn't have to be in a cookie.)

When your application grants those authorization artifacts, you can keep a link back to a user, and then manage them as a one-to-many relationship -- one user has many tokens. Then you provide all the usual operations like list all, filter/search, delete, etc.

Usually, when a service or framework grants a new authorization artifact, it just looses track of the old ones. So there's an implicit one-to-many (one user, many sessions), except that the other sessions are just lost and eventually cleaned up. But you can track them explicitly if you keep a link to the user account.

Not the answer you're looking for? Browse other questions tagged or ask your own question.