Skip to main content

Revoking a session manually

Method 1: Revoking via the req object.#

important

We provide a default sign out API that does something very similar to the code below. So please have a look at that page first.

let supertokens = require("supertokens-node");let Session = require("supertokens-node/recipe/session");
app.use("/logout", Session.verifySession(), async (req, res) => {
    // This will delete the session from the db and from the frontend (cookies)    await req.session.revokeSession();
    res.send("Success! User session revoked");});
tip

When calling this API from the frontend, please be sure to treat a 401 response as successful. The reason is that 401 means the session has expired, which is equivalent to a successful logout.

Method 2: Revoking a session using a sessionHandle.#

caution

This and the remaining methods below do not use the req object, so they will only delete the session from the db and not from the frontend.

This implies that the user will still be able to access protected endpoints while their access token is alive (unless you enable access token blacklisting).

let supertokens = require("supertokens-node");let Session = require("supertokens-node/recipe/session");
app.use("/revoke-user-session", async (req, res) => {
    let sessionHandle = req.body.sessionHandle
    // sessionHandle is a string[]    await Session.revokeSession(sessionHandle); 
    res.send("Success! User session revoked");});

Method 3: Revoking multiple sessions using an array of sessionHandle.#

let supertokens = require("supertokens-node");let Session = require("supertokens-node/recipe/session");
app.use("/revoke-multiple-sessions", async (req, res) => {
    let sessionHandles = req.body.sessionHandles    await Session.revokeMultipleSessions(sessionHandles);
    res.send("Success! All user sessions have been revoked");});

Method 4: Revoking all sessions for a userId.#

let supertokens = require("supertokens-node");let Session = require("supertokens-node/recipe/session");
app.use("/revoke-all-user-sessions", async (req, res) => {
    let userId = req.body.userId    await Session.revokeAllSessionsForUser(userId); 
    res.send("Success! All user sessions have been revoked");});