{"action":"created","issue":{"url":"https://api.github.com/repos/gorilla/sessions/issues/86","repository_url":"https://api.github.com/repos/gorilla/sessions","labels_url":"https://api.github.com/repos/gorilla/sessions/issues/86/labels{/name}","comments_url":"https://api.github.com/repos/gorilla/sessions/issues/86/comments","events_url":"https://api.github.com/repos/gorilla/sessions/issues/86/events","html_url":"https://github.com/gorilla/sessions/issues/86","id":164461077,"number":86,"title":"Invalidating Other Sessions (no concurrent logged-in users)","user":{"login":"Zamiell","id":5511220,"avatar_url":"https://avatars.githubusercontent.com/u/5511220?v=3","gravatar_id":"","url":"https://api.github.com/users/Zamiell","html_url":"https://github.com/Zamiell","followers_url":"https://api.github.com/users/Zamiell/followers","following_url":"https://api.github.com/users/Zamiell/following{/other_user}","gists_url":"https://api.github.com/users/Zamiell/gists{/gist_id}","starred_url":"https://api.github.com/users/Zamiell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zamiell/subscriptions","organizations_url":"https://api.github.com/users/Zamiell/orgs","repos_url":"https://api.github.com/users/Zamiell/repos","events_url":"https://api.github.com/users/Zamiell/events{/privacy}","received_events_url":"https://api.github.com/users/Zamiell/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-07-08T05:24:17Z","updated_at":"2016-07-08T16:44:02Z","closed_at":null,"body":"First off, a thanks is in order - `gorilla/sessions` has excellent documentation and very helpful examples on the website. Thank you!\r\n\r\nOne seemingly common use-case that is not covered in the docs is the scenario of when a user logs in, all other sessions from that user should be invalidated. How is this supposed to be tacked using `gorilla/sessions`?\r\n\r\nHere's a code snippet to illustrate the problem:\r\n\r\n```\r\nfunc loginHandler(w http.ResponseWriter, r *http.Request) {\r\n\t// Get the POSTed credentials\r\n\t// [omitted, just going to hardcode a username for now]\r\n\tusername := \"Fred\"\r\n\r\n\t// Check the database to see if it is a valid login\r\n\t// [omitted, we checked the credentials and it passed, so we can proceed]\r\n\r\n\t// Establish a session cookie using gorilla/sessions\r\n\tsession, _ := sessionStore.Get(r, sessionName)\r\n\tsession.Values[\"logged_in\"] = true\r\n\tsession.Values[\"username\"] = username\r\n\tsession.Save(r, w)\r\n\r\n\t// Set \"logged_in\" equal to false for all other sessions with a username of username\r\n\t// [?????]\r\n}\r\n```\r\n\r\nAfter some searching around, I did find the following GitHub issue that tangentially discusses this: https://github.com/gorilla/sessions/issues/67\r\n\r\nHowever, I wasn't able to completely follow the discussion, as it implies that the programmer should create a custom Store implementation, and I'm fairly new to Golang.\r\n\r\nApart from this, one possible way that I thought of to solve this problem is to use the `michaeljs1990/sqlitestore` implementation of `gorilla/sessions`. Then, I could just iterate over the sessions in the table and manually mess with the session values for any row that matched the username. However, this seems a bit hacky, and I wonder if it is the \"wrong\" solution.\r\n\r\nThanks again for reading."},"comment":{"url":"https://api.github.com/repos/gorilla/sessions/issues/comments/231410372","html_url":"https://github.com/gorilla/sessions/issues/86#issuecomment-231410372","issue_url":"https://api.github.com/repos/gorilla/sessions/issues/86","id":231410372,"user":{"login":"Zamiell","id":5511220,"avatar_url":"https://avatars.githubusercontent.com/u/5511220?v=3","gravatar_id":"","url":"https://api.github.com/users/Zamiell","html_url":"https://github.com/Zamiell","followers_url":"https://api.github.com/users/Zamiell/followers","following_url":"https://api.github.com/users/Zamiell/following{/other_user}","gists_url":"https://api.github.com/users/Zamiell/gists{/gist_id}","starred_url":"https://api.github.com/users/Zamiell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zamiell/subscriptions","organizations_url":"https://api.github.com/users/Zamiell/orgs","repos_url":"https://api.github.com/users/Zamiell/repos","events_url":"https://api.github.com/users/Zamiell/events{/privacy}","received_events_url":"https://api.github.com/users/Zamiell/received_events","type":"User","site_admin":false},"created_at":"2016-07-08T16:44:02Z","updated_at":"2016-07-08T16:44:02Z","body":"I've messed around with the cookie a little and even after setting all of that stuff, I still encounter the same functionality:\r\n\r\n```\r\n// Create a session store\r\nsessionSecret := os.Getenv(\"SESSION_SECRET\")\r\nsessionStore = sessions.NewCookieStore([]byte(sessionSecret))\r\nsessionStore.Options = &sessions.Options{\r\n\tDomain:   domainName,\r\n\tPath:     \"/\",\r\n\tMaxAge:   86400, // 1 day\r\n\tSecure:   true, // Only send the cookie over HTTPS: https://www.owasp.org/index.php/Testing_for_cookies_attributes_(OTG-SESS-002)\r\n\tHttpOnly: true, // Mitigate XSS attacks: https://www.owasp.org/index.php/HttpOnly\r\n}\r\n```"}}
{"actor":{"display_login":"Zamiell"}}