Ruby-on-rails 如何重置所有设备会话以便每个用户都必须再次登录？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/16406208/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How can I reset all devise sessions so every user has to login again?
提问by JB.
At some mystery point X with this rails app hosted on heroku, a logged in user would suddenly be logged in as another user. I am using the devise gem for authentication.
在 heroku 上托管这个 rails 应用程序的某个神秘点 X 上，登录的用户会突然以另一个用户的身份登录。我正在使用设计 gem 进行身份验证。
This has occurred for 2 users that we know of. I am currently tracking down what the root cause of this issue could be.
这发生在我们知道的 2 个用户身上。我目前正在追踪这个问题的根本原因。
What I need to do right now is invalidate all devise sessions in order to force users to login again. After a user logs in, the problem seems to go away.
我现在需要做的是使所有设计会话无效，以强制用户再次登录。用户登录后，问题似乎消失了。
I tried reseting my secret_token but I was not forced to login again. I then scaled my web dynos down and then back up. I also restarted the app. All trying to get the secret_token change to reset the sessions.
我尝试重置我的 secret_token，但我没有被迫再次登录。然后我缩小了我的网络测功机，然后再放大。我也重新启动了应用程序。所有人都试图获得 secret_token 更改以重置会话。
Any other ideas?
还有其他想法吗？
采纳答案by Jesse Wolgamott
Changing your session_token will work if you're storing your sessions in cookies (default).
如果您将会话存储在 cookie 中（默认），则更改 session_token 将起作用。
But if you're storing in active_record, then you can delete all the sessions by:
但是，如果您存储在 active_record 中，则可以通过以下方式删除所有会话：
rake db:sessions:clear
then: BAM! no more sessions.
然后：砰！没有更多的会话。
回答by djcp
You should be able to change your session cookie name to invalidate all sessions, which lives in config/initializers/session_store.rb
您应该能够更改会话 cookie 名称以使所有会话无效，这些会话位于 config/initializers/session_store.rb
YourApp::Application.config.session_store :cookie_store, key: '_change_me_session'
回答by lab419
Update on the accepted answer, now it is
更新已接受的答案，现在是
rake tmp:clear
rake tmp:clear
rake -T
...
rake tmp:create # Creates tmp directories for sessions, cache, sockets, and pids
rake -T
...
rake tmp:create # Creates tmp directories for sessions, cache, sockets, and pids
回答by Matchu
If your sessions don't store any other critical information, you could clear the sessions:
如果您的会话不存储任何其他关键信息，您可以清除会话：
rake db:sessions:clear
回答by catsby
Devise has a thing called timeoutablecan you work with that?
Devise 有一个叫做timeoutable的东西，你能用它吗？
回答by Abram
Check out
查看
module ClassMethods
Devise::Models.config(self, :timeout_in)
end
I'm just guessing that you could do something like:
我只是猜测您可以执行以下操作：
User.all.each do |user|
user.timeout_in 1.second
end
But I'm not sure if this only manages new sessions.. and not existing ones?
但我不确定这是否只管理新会话......而不是现有会话？
Actually this is overly complex.. just try:
其实这太复杂了..试试吧：
User.all.each do |user|
sign_out user
end
See this post Log out all user with Devise
请参阅这篇文章使用 Devise 注销所有用户
to do something like this from the console you will need to check out this example and adjust it for your needs
要从控制台执行类似操作，您需要查看此示例并根据您的需要进行调整
回答by plombix
sign_out_all_scopes(lock = true) ? Object
sign_out_all_scopes(lock = true) ？目的
Sign out all active users or scopes. This helper is useful for signing out all roles in one click. This signs out ALL scopes in warden. Returns true if there was at least one logout and false if there was no user logged in on all scopes.
注销所有活动用户或范围。此助手可用于一键注销所有角色。这标志着典狱长中的所有范围。如果至少有一次注销，则返回 true，如果没有用户登录所有范围，则返回 false。
source: http://www.rubydoc.info/github/plataformatec/devise/Devise/Controllers/SignInOut
来源：http: //www.rubydoc.info/github/plataformatec/devise/Devise/Controllers/SignInOut
回答by Arjun
When cookie store is used, we have to regenerate the app secret_token which is used to encrypt the cookies.
当使用 cookie 存储时，我们必须重新生成用于加密 cookie 的应用程序 secret_token。
file to configure secret_token: config/initializers/secret_token.rb
配置secret_token的文件： config/initializers/secret_token.rb
bundle exec rake secretCan be used to generate a new secret token.
bundle exec rake secret可用于生成新的秘密令牌。
https://www.tigraine.at/2012/08/03/how-to-expire-all-active-sessions-in-rails-3
https://www.tigraine.at/2012/08/03/how-to-expire-all-active-sessions-in-rails-3
