How does play validate a cookie?
- I noticed that after I restarted the server I was still logged in even though I
don't presist any session data in the database.
- I also noticed
that I could set the date on the server to be larger that the exipry
date of the cookie and still I was logged in.
- I logged out (saved the cookie to a text file) and the browser lost the cookie. Then I recreated the cookie from the text file and I was logged in again.
The cookie looks like this:
PLAY_SESSION=e6443c88da7xxxxxxxxxxxxxxxxxxxxxxxxxxxxx-userid%3A1
// My logout code
def logout() = Action {
Ok("").withNewSession
}
From the documentation
Discarding the whole session
There is special operation that discards the whole session:
Ok("Bye").withNewSession