How to invalidate specific session at logout in Rails /w Devise?

Question

I want to invalidate the session when a user logs out using Devise, i have a callback to catch when a user logs out, for more protection against session hijacking.

class ApplicationController < ActionController::Base
  def sign_out(*args)
    super(*args)
    reset_session
  end
end

My understanding was that this would remove the session info stored on the server side, therefore invalidating it.

However I can still login using the session id I got before signing out. Am I misunderstanding how it works? I only want to invalidate just this session, not all of them.

I am using the default for session_store.

Answer 1

After some googling and meditating, I came apon this question, which could be modified to fit my needs,

all I did was

application_controller.rb

  def sign_out(*args)
    current_user.update_attribute(:current_sign_in_token, "")
    super
  end

which will invalidate the sign_in_token, thus invalidating the session, so hijacking the session id will still get you kicked out.