How to invalidate all active sessions?

[antonywhatever]

How to invalidate ALL active sessions?

We have something like ToS which the user implicitly accepts when he completes the flow and gets the token.

In the case of the ToS update I need to invalidate all active sessions so users with session cookie containing information about a previously successful login set will have to re-authenticate.

I did a little research:

1. I couldn't find anything related in CLI
2. janitor works with the stale data, with expired sessions
3. the HTTP API has an operation to revoke the authentication sessions per subject or sid
4. I unable to find any kind of mass logout operation

[vinckr]

Hello @antonywhatever

Ory does not provide a direct way to invalidate all active sessions at once.

There are a few methods available to invalidate sessions on a per-user basis in Ory Kratos Identity server.
You should be using Ory Kratos or something similar that implements user management.

• Refreshing a Session
  When a user's password is updated, you can refresh their login session. This updates the authenticated_at time but does not log the user out unless another user signs in. To refresh a session, append ?refresh=true to the login URL. For example, for browser clients, the URL would be https://playground.projects.oryapis.com/self-service/login/browser?refresh=true and for API clients, the URL would be https://playground.projects.oryapis.com/self-service/login/api?refresh=true source: https://www.ory.sh/docs/kratos/self-service/flows/user-login.
• Revoke Active Sessions
  You can revoke all active sessions of a user when they successfully recover their account. This forces anyone with access to the account to re-authenticate using the new password set up in the recovery process. To trigger this behavior, use the after_recovery hook. You can add the hook configuration to the Ory Identities config file and then update the configuration using the Ory CLI source.
• Revoke Session API
  You can revoke specific sessions using the revoke session API. This allows users to log out from their account on different devices or terminate sessions they don't recognize and suspect of malicious activity. Sessions revoked by users are not deleted from the system. Instead, they become inactive. Only administrators can delete sessions using the administrative endpoints source.

There is also something in Ory Hydra, but it is not really what you are looking for I presume (unless you want to relogin at Hydra as well?)

• Revoke OAuth 2.0 Login Sessions
  This endpoint invalidates authentication sessions. After revoking the authentication session(s), the subject has to re-authenticate at the Ory OAuth2 Provider. This endpoint does not invalidate any tokens. You can send the subject in a query param, all authentication sessions that belong to that subject are revoked. Alternatively, you can send a SessionID via sid query param, in which case, only the session that is connected to that SessionID is revoked source.