Let people sign out of one device or all of them

How to do it

Delete the session row on the server. With cookie sessions that is enough, because the next request finds no row. With access tokens, revoke the refresh token, and keep access tokens at 15 minutes or less, as verify every token says. Also check ended session IDs on each request until their access tokens expire, or an ended session keeps working for up to 15 minutes. Record each sign-out in the security log.

Example

app.post('/account/sessions/:id/end', requireUser, async (req, res) => {
  await db.none('DELETE FROM sessions WHERE id = $1 AND user_id = $2', [req.params.id, req.user.id]);
  await securityLog.append({ userId: req.user.id, type: 'session.ended', sessionId: req.params.id });
  res.redirect(303, '/account/sessions');
});

@app.post("/account/sessions/<session_id>/end")
@login_required
def end_session(session_id: str):
    db.execute("DELETE FROM sessions WHERE id = %s AND user_id = %s", (session_id, current_user.id))
    security_log.append(user_id=current_user.id, type="session.ended", session_id=session_id)
    return redirect("/account/sessions", code=303)

How to check

Sign in from two browsers. From the first, end the second session. The second browser's next request answers 401 or shows the sign-in page.