How to invalidate a session? about yar HOT 2 CLOSED

Hi @kfir124

1. Yar and auth-cookie are parallel projects, but not connected in any way. I'm not intimately familiar with AC, but I'll give this question a shot. Yar is simpler to use IMO. AC has additional complexities. Auth-cookie, as the name suggests, ties into the authentication layer of Hapi and so requires a user be logged in to use it. Yar has no such requirements. Sessions are independent of logins. Another difference, as I understand it, is in storage size. Yar handles arbitrary length data sizes but automatically dropping data into the hapi cache layer if necessary, though it tries to use cookies where it can. AC can use a cache fallback, but you have to handle that manually. I'd suggest just looking over the docs for both and seeing which seems to appeal more.
2. When the user logs out use yar.reset() to clear out the session.
3. That's trickier. I'm afraid there's no direct way to target a specific session of another browser/user. You'll need to write some code to check for invalidated sessions and clear them, or double check admin permissions instead of relying on the session to grant access. Something like that.

Using yar with redis is very common. Just setup redis as your hapi caching layer (https://github.com/hapijs/catbox-redis) and you're all good. Yar will do the rest.

The session id is kept in the cookie, and the cookie is always encrypted.

from yar.

This thread has been automatically locked due to inactivity. Please open a new issue for related bugs or questions following the new issue template instructions.

from yar.