With some platforms, like LinkedIn, you can see a list of all sessions where you are logged in, and you can even log them out on a distance.

enter image description here

How would you implement something like that? I'm not talking about specific code, but more about general flow.

I am using ASP.NET myself, but I think a general approach would be more useful for others.

Right now I'm thinking about something like this:

  • User logs in, validate email/password combination
  • Generate GUID, save to database together with UserId and Browser information.
  • Put Cookie in a serverside-read-only cookie.
  • When user wants to sign out from a distance, we remove the GUID in the database.

One of the security issues here would be that the GUID can get intercepted, and an attacker could use this to login.

So how to do this properly?

closed as too broad by GlenH7, user40980, Kilian Foth, Mark Booth, gnat Jan 7 '15 at 19:52

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Yup, that's how you do it. You're probably doing everything except the last step already, since you've got to have some kind of server-side persistence to have sessions across HTTP requests at all. – Ross Patterson Dec 28 '14 at 16:02

Every session is going to have some authorization artifact it uses to track sessions. (In web applications, usually this is a token in a cookie, although it doesn't have to be in a cookie.)

When your application grants those authorization artifacts, you can keep a link back to a user, and then manage them as a one-to-many relationship -- one user has many tokens. Then you provide all the usual operations like list all, filter/search, delete, etc.

Usually, when a service or framework grants a new authorization artifact, it just looses track of the old ones. So there's an implicit one-to-many (one user, many sessions), except that the other sessions are just lost and eventually cleaned up. But you can track them explicitly if you keep a link to the user account.

Not the answer you're looking for? Browse other questions tagged or ask your own question.