Reference · Cookies and sessions

end_session

end_session() -> null

What it does

Forgets the visitor's session: the session cookie is removed from the browser with the request's answer, and session() is {} from here on. Logging out. It gives null. set_session(null) does the same. See Headers, cookies and sessions.

Examples

route POST /logout { end_session(); redirect("/") }route GET / =    <header>        {session().user != null            ? <form method="post" action="/logout"><button>Log out</button></form>            : <a href="/login">Sign in</a>}    </header>

Logging out is a form posting to the route, not a link: a GET would let any page log the visitor out with an <img>, and a post from another site is refused with 403. The answer carries set-cookie: quillo_session=; Path=/; Max-Age=0 (in production the name is __Host-quillo_session), and the page it redirects to shows Sign in.

set_session({ user: 7 })print(end_session())print(session())

null{}

Edge cases

• Ending a session that does not exist is fine: the cookie's removal goes out and session() stays {}.
• It removes the cookie from one browser. A copy someone kept stays valid until it expires: to sign out everywhere, keep a session id in the session and a table of live ids, delete from the table, then end_session().
• Other cookies stay; delete_cookie removes those.
• A session set again later in the same request replaces the removal: the last set_session or end_session wins. Inside parallel's functions it works too, the functions taken in their order: parallel(() => end_session(), ...) signs the visitor out (it was dropped, and the visitor stayed signed in).

print(end_session(), session())end_session()set_session({ user: 8 })print(session())

null {}{ user: 8 }

Errors

It takes no arguments and never fails.

print(end_session() == null)

true

Chaining

It is a statement before the route's answer. Signing out everywhere:

route POST /logout/everywhere {    let id = session().user ?? reply 401 "Log in first"    db.exec("delete from sessions where user_id = ?", id)    end_session()    redirect("/")}

See also

session, set_session, delete_cookie, redirect

Edit this page on GitHub · every example's output was made by running it (tools/refcheck.mjs) · questions on Discord or r/quillo