josephspurrier / gowebapp

Basic MVC Web Application in Go
MIT License
1.14k stars 197 forks source link

How to remove any user session? #46

Closed problama closed 3 years ago

problama commented 4 years ago

I'm wondering how can a moderator force ANY user to logout when needed?

I unserstand that logout is done like this:

`sess := session.Instance(r)
// If user is authenticated
if sess.Values["id"] != nil {
    session.Empty(sess)
    sess.AddFlash(view.Flash{"Goodbye!", view.FlashNotice})
    sess.Save(r, w)
}`

And the instance is obtained like this:

// Instance returns a new session, never returns an error
func Instance(r *http.Request) *sessions.Session {
    session, _ := Store.Get(r, Name)
    return session
}

But I could not figure out how to get a user's session.Instance by userID instead of r *http.Request?

josephspurrier commented 3 years ago

Late reply. You'd have to add in that functionality yourself. Gorilla sessions handles the sessions - you may have to track which cookies are revoked. I don't know if it stores the cookies in app memory or not.