I also have a question about authentication. When a user logs out, how do we invalidate the UserIdPr...

# ktor

[codec]

I also have a question about authentication. When a user logs out, how do we invalidate the UserIdPrincipal and clear out the UserPasswordCredential?

[crummy]

this is what I do:

call.sessions.clear<User>()

[codec]

is User your own custom class?

[crummy]

yeah

[codec]

how could that possibly work tho?

[codec]

if the UserPrincipal object is still in existence?

[crummy]

I don't know the internals. But I believe this code that I'm using sets up an internal storage of Users:

cookie<User>(USER_SESSION, SessionStorageMemory()) {
            cookie.path = "/"
        }

I believe calling call.sessions.clear will clear the cookie in the response, and also remove the user from internal storage.

[codec]

ok, i’ll try that.