title: How to invalidate all sessions after user log out in Rails?
body: <p>I am new to Rails and I am following Michael Hartl's Rails Tutorial, so my code is mostly borrowed from there. Here is the scenario:</p>
  
  <p>I log onto my site using <code>Computer A</code>. Then I log onto the site using the same user id using <code>Computer B</code>. When I log out of the site using <code>Computer A</code>, <code>Computer B</code> remains logged in and can still perform actions. For security reasons, I would like <code>Computer B</code> to be forced to login again when <code>Computer A</code> has logged out. Is there an easy way to invalidate all sessions for a given user upon log out? If you have some sample code that would be very much appreciated.</p>
  
  <p>I also read that it is best practice to use reset_session on log out. However, I had trouble determining whether you should use <code>reset_session</code> before or after logging out the user?</p>
  
  <p>This is from my Sessions Controller:</p>
  
  <pre><code>  def destroy
  
      log_out if logged_in?
  
       # Reset session to prevent session fixation vulnerability
      reset_session
  
      flash[:info] = "You are now logged out"
      redirect_to root_url
    end
  </code></pre>
  
  <p>This is from my Sessions Helper:</p>
  
  <pre><code>  # Forgets a persistent session
    def forget(user)
      user.forget
      cookies.delete(:user_id)
      cookies.delete(:remember_token)
    end
  
    # Logs out the current user
    def log_out
      forget(current_user)
      session.delete(:user_id)
      @current_user = nil
    end
  </code></pre>