Keep a way to sign everyone out at once

How to do it

OWASP ASVS 5.0 requirement 7.4.5 asks that admins can end sessions for one user or for all users. You need it after a leaked session signing key, a breached session store or a bug that mixed up sessions. With sessions on the server, delete every row. With signed tokens, store one "sessions valid after" time and refuse older tokens. Let organisation owners sign a member out does for one organisation. Rotate the signing key in the same step when the key leaked. Copy the session list first when the cause is an attack, as keep evidence in security incidents asks. Write an audit event naming the staff member.

Examples

JavaScript example

export async function signEveryoneOut(db, staffId) {
  await db.tx(async tx => {
    await tx.none("UPDATE settings SET sessions_valid_after = now() WHERE name = 'global'");
    await tx.none('DELETE FROM sessions');
    await tx.none('DELETE FROM refresh_tokens');
  });
  await audit.append({ actor: staffId, type: 'sessions.all_ended' });
}

Python example

def sign_everyone_out(conn, staff_id: str) -> None:
    with conn.transaction():
        conn.execute("UPDATE settings SET sessions_valid_after = now() WHERE name = 'global'")
        conn.execute("DELETE FROM sessions")
        conn.execute("DELETE FROM refresh_tokens")
    audit.append(actor=staff_id, type="sessions.all_ended")

How to check

On staging, sign in three test users with cookies and one with an access token. Run the action. Every next request answers 401 within 1 minute, and the audit log holds one event with the staff member's ID.

Sources

• OWASP ASVS 5.0 V7 Session Management

Related rules

• Let organisation owners sign a member out in Accounts
• Keep evidence in security incidents in Operations