{"action":"created","issue":{"url":"https://api.github.com/repos/gorilla/sessions/issues/60","labels_url":"https://api.github.com/repos/gorilla/sessions/issues/60/labels{/name}","comments_url":"https://api.github.com/repos/gorilla/sessions/issues/60/comments","events_url":"https://api.github.com/repos/gorilla/sessions/issues/60/events","html_url":"https://github.com/gorilla/sessions/issues/60","id":121925151,"number":60,"title":"How to clear another user session ?","user":{"login":"tbruyelle","id":92280,"avatar_url":"https://avatars.githubusercontent.com/u/92280?v=3","gravatar_id":"","url":"https://api.github.com/users/tbruyelle","html_url":"https://github.com/tbruyelle","followers_url":"https://api.github.com/users/tbruyelle/followers","following_url":"https://api.github.com/users/tbruyelle/following{/other_user}","gists_url":"https://api.github.com/users/tbruyelle/gists{/gist_id}","starred_url":"https://api.github.com/users/tbruyelle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tbruyelle/subscriptions","organizations_url":"https://api.github.com/users/tbruyelle/orgs","repos_url":"https://api.github.com/users/tbruyelle/repos","events_url":"https://api.github.com/users/tbruyelle/events{/privacy}","received_events_url":"https://api.github.com/users/tbruyelle/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/gorilla/sessions/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-13T15:27:28Z","updated_at":"2015-12-15T09:31:21Z","closed_at":null,"body":"From an admin interface in a website, I can disable a user, and in that case, I would like also to remove his current session, in order to disconnect him instantly.\r\n\r\nFrom what I see I can only access the session with `http.Request`, but in that case I don't want to access my session but the one from another user. Can I do that ?\r\n\r\n(I know I can also check the database each time I get a session to see if the user is disabled, but I wonder if it's possible without a db access)"},"comment":{"url":"https://api.github.com/repos/gorilla/sessions/issues/comments/164699036","html_url":"https://github.com/gorilla/sessions/issues/60#issuecomment-164699036","issue_url":"https://api.github.com/repos/gorilla/sessions/issues/60","id":164699036,"user":{"login":"elithrar","id":18544,"avatar_url":"https://avatars.githubusercontent.com/u/18544?v=3","gravatar_id":"","url":"https://api.github.com/users/elithrar","html_url":"https://github.com/elithrar","followers_url":"https://api.github.com/users/elithrar/followers","following_url":"https://api.github.com/users/elithrar/following{/other_user}","gists_url":"https://api.github.com/users/elithrar/gists{/gist_id}","starred_url":"https://api.github.com/users/elithrar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elithrar/subscriptions","organizations_url":"https://api.github.com/users/elithrar/orgs","repos_url":"https://api.github.com/users/elithrar/repos","events_url":"https://api.github.com/users/elithrar/events{/privacy}","received_events_url":"https://api.github.com/users/elithrar/received_events","type":"User","site_admin":false},"created_at":"2015-12-15T09:31:21Z","updated_at":"2015-12-15T09:31:21Z","body":"Hi @tbruyelle —\r\n\r\nIn short: when using the cookies, you can't.\r\n\r\nCookies (in general, beyond this package) are stateless—they may contain an expiry/max. age, but there's no way to forcibly expire them without maintaining some state somewhere. Typically, this would be in a database, and you would look up that user on login (or every request) based on a user ID stored in the cookie.\r\n\r\nThe alternative is to use cookies backed by a database, which might be Redis, BoltDB, Postgres, etc. The cookie just stores an ID and that's used on each request to lookup the associated session in the DB. You can then—with an interface to do so—expire sessions based on a session ID <=> user ID mapping. \r\n\r\nNote that this isn't a limitation of this package, just cookies in general. Being able to forcibly expire sessions is one of the advantages of server-side sessions."}}