How does "Logout Everywhere" work in PHP?

Question

I just found out that stackoverflow has a link to logout every logged computers.

So..I thought about how to implement same functionality in PHP. I came up with using session_set_save_haldner to control write() method. In write() method, I can make a session file start with user's username. For example, a user john might have session files john_kdkajdkak, and john_29039dla. When John clicks "Logout Everywhere", I can write a code that finds filenames start with "john" then remove them to clear sessions.

are there any other better solutions? How did you implement it if you already made it work?

Answer 1

Use a database to persist session data.

Using session_set_save_handler you can roll your own database storage backend for user sessions - a sessions that has a user_id foreign key, related to the users table. A "logout everywhere" button would trigger simple DELETE FROM sessions WHERE user_id = 1234 and invalidate every session for the user.

You can also easily add in additional columns to the session table - to store the IP address of the session, for instance, so users can see where other sessions are logged in from.

Use a database for flexibility and performance.