mendomedia
I’m plotting out a new project with authentication and role-based authorization for parts of the app. One of the asks form the client is the ability to kill the logged-in session of a user if they’re deemed to be violating policy.
It seems the more elegant approach would be to define a role where a user can’t access anything except maybe a page explaining that they’re essentially in a time-out and an admin can just move them there.
Would there be other options? Maybe a way to kill their existing session?
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
At WyeWorks, we believe great software is built by combining technical excellence with genuine human connection
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #ai
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #blog-post
- #ecto-query
- #elixirconf-us
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Producing high quality Elixir screencasts since 2017.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Most Liked- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
jc00ke
Even if you killed the session, they could log in again, right? If so, seems like you’d want to set something on the user, whether it’s a
in_timeout: trueorrole: bannedso that they, like you mentioned, see a specific page, or can’t log in at all.pedromvieira
Guardian with Guardian DB and revoke JWT token will kill user session.
axelson
I think the easiest is if you simply store the sessions in the database, then you can just remove the session from the database and update their user account to a
bannedstatus so that they cannot log in.Last Post!
mendomedia
Ah, I totally spaced on considering sessions in the db. Excellent.