Stolen laptop. "Log out everywhere." The thief stays in.

transcript

Your laptop gets stolen. You tap log out everywhere. The thief stays logged in. For up to 24 hours.

Here's why. The session is a signed JWT, inside the cookie itself. Your user ID and roles. It's valid for 24 hours. The server checks the signature. That's all. The server keeps no record of it. Nothing to look up. Nothing to delete. So the signature still checks out. The thief's next request goes straight through.

It's tempting. No session storage. Infinite scale. It even works across datacentres, with no replication. But you can't invalidate it before it expires. And it's capped at a 4 kilobyte cookie, sent in full every time.

The fix is a hybrid. The cookie still carries the basics: user ID and roles. But the full session also lives in a store the server controls. Log out everywhere? Mark it invalid in the store. It no longer lives out its 24 hours.

And every device at once? On each login, add the session ID to a per-user set. Logout everywhere reads the set, and deletes every session in one round trip.

If the server stores nothing, it has nothing to revoke. Keep a record you can mark invalid. Then logout means logout.

Full breakdown in the lecture.