How would you implement logout on every device without scanning Redis?

Say it in 30 seconds

Say it like this (20-30 seconds)

I index each user’s active session hashes and revoke that bounded set atomically. MiniTickets uses a Redis sorted set and retains at most twenty device sessions. A Lua script deletes their records and the index together. That avoids a global scan and makes revocation shared across API tasks. It does not cancel work that already passed authentication, and a concurrent fresh login can create a new session after revocation.

The deeper answer

Creation writes the session and index entry in one Redis script, sets their expiry and removes the oldest session if the user exceeds twenty. Revocation reads only that user’s index. Its cost depends on the device cap, rather than the number of users in the system.

Session reads also verify index membership. If memory eviction removes an index, surviving session records fail closed. That reduces the risk of orphaned session records remaining usable, but it can log users out unexpectedly because sessions share the cache store.

Atomic means Redis commands cannot interleave inside the script. It does not create a transaction across Postgres, Redis and a request already running in another process. For a stronger security event, I would define whether new logins must be blocked and whether sensitive operations need a fresh authorization check.

Counter-questions

Why hash the session identifier?

A read of Redis keys does not directly reveal a usable browser token. The raw random identifier is still sensitive in the cookie and must not enter logs.

What if Redis fails midway through the request?

The operation reports an error instead of claiming that all devices were revoked. The client should not interpret removal of its own cookie as proof that every server-side session disappeared.

Would a user session version be simpler?

It can make revocation a constant-size write, but every authentication check must compare versions. Persistent versions, cache loss and concurrent login semantics still need a precise design.

Where in MiniTickets

Read Auth sessions, then inspect the sessions piece →.

apps/api/src/queries/sessions.ts → revokeAll