CODEWITHSUNDEEP
javascriptnode.jssession
Below the Radar
Below the Radar

Reputation: 7635

Express 4 - Destroy all sessions from an admin request

I want the admin of an application to be able to destroy all regular user's sessions.

In express 4, we can destroy a session using 

req.session.destroy();

but this function destroy the session attached to the request. Is there a way to destroy all sessions except the current request session which is the admin's session? How can I access all sessions from a request?

Upvotes: 0

Views: 1189

Answers (1)

Gergo
Gergo

Reputation: 2290

It depends on the session store do you use. You need to delete sessions from it.

If you use MongoDB, you can easily remove the specified sessions:

db.sessions.remove({admin:false})

With redis, the easiest way flush he whole database, but you will delete your current session too.

flush db

You can iterate over the keys and delete it one by one, but I don't recommend it. The redis keys(*) lock the database, and with a million user, it can be a big problem.

Upvotes: 1

Related Questions