Global sign-out
The security button that ends every active login for an account, including sessions on phones and browsers you cannot reach.
See it
What it is
Global sign-out invalidates every active session for one account, not just the cookie in the browser that clicked Log out. With server-side sessions, that means revoking every session row for the user. With an OAuth-style setup, it also means revoking refresh-token families so clients cannot mint fresh access tokens.
Reach for it after a password change, a lost phone, suspicious account activity, or an administrator disabling an account. It is also the button people expect beside a list of signed-in devices, the way Netflix offers Sign out of all devices and Gmail keeps Sign out of all other web sessions at the bottom of the inbox. Make the revocation authoritative on the server so a copied cookie stops working even if the original browser never receives the logout response.
The gotcha is that already-issued access tokens may remain usable until they expire unless APIs check revocation or introspect them. Clearing cookies only reaches the current browser, and signing out of an identity provider does not reliably close every downstream app. Keep access tokens short-lived and define exactly whether 'everywhere' means this app, every app in your product, or the whole SSO estate.
Ask AI for it
Add global sign-out to this app. In one database transaction, set revoked_at on every active session and every refresh-token family for the user, increment a per-user session_version, and clear the current HttpOnly session cookie. Make every authenticated request reject a session whose version is stale or whose revoked_at is set. Publish the user ID over Redis Pub/Sub so all API instances evict cached auth decisions immediately, and call the OAuth 2.0 revocation endpoint from RFC 7009 for any provider refresh tokens stored by this app. Add a 'Sign out all devices' confirmation, an audit-log event, and tests proving that two browsers and one mobile session all fail on their next request.