# Session Management

> Documentation on using the ISessionManagementService to query and terminate user sessions in IdentityServer, including revoking tokens and sending back-channel logout notifications.

When using server-side sessions, there is a record of the userâs authentication activity at IdentityServer. This allows administrative and management tooling to be built on top of that data to query those sessions, and terminate them. In addition, since the session data has its own unique id and tracks clients that a user has used, then some types of tokens issued to these clients can be revoked. Finally, if clients support back-channel logout, then they can be notified that a userâs session has been terminated, which allows them to also terminate the userâs session within the client application.

These features are all provided via the `ISessionManagementService` service.

## ISessionManagementService

[Section titled âISessionManagementServiceâ](#isessionmanagementservice)

The [session management service](/identityserver/reference/services/session-management-service/) provides administrative operations for querying and revoking the server-side sessions.

### Quickstart UI

[Section titled âQuickstart UIâ](#quickstart-ui)

The Quickstart UI contains a simple administrative page (under the âServerSideSessionsâ folder) that uses the `ISessionManagementService` API.

Note

The Quickstart session administrative page requires a logged-in user to manage sessions. We strongly recommend that you add additional authorization suitable to your organization by adding an authorization policy.

The session management page looks like this by default, but of course you are free to customize or change it as needed:

![A table showing the active user sessions in IdentityServer](/_astro/session_query.wIxtrUVu_BT8Du.webp)

### Querying Sessions

[Section titled âQuerying Sessionsâ](#querying-sessions)

Use the `QuerySessionsAsync` API to access a paged list of user sessions. You can optionally filter on a userâs claims mentioned above (subject identifier, session identifier, and/or display name).

For example:

```csharp
var userSessions = await _sessionManagementService.QuerySessionsAsync(new SessionQuery
{
    CountRequested = 10,
    SubjectId = "12345",
    DisplayName = "Bob",
});
```

The results returned contains the matching usersâ session data, and paging information (depending on if the store and backing database supports certain features such as total count and current page number).

This paging information contains a `ResultsToken` and allows subsequent requests for next or previous pages (set `RequestPriorResults` to true for the previous page, otherwise the next page is assumed):

```csharp
// this requests the first page
var userSessions = await _sessionManagementService.QuerySessionsAsync(new SessionQuery
{
    CountRequested = 10,
});


// this requests the next page relative to the previous results
userSessions = await _sessionManagementService.QuerySessionsAsync(new SessionQuery
{
    ResultsToken = userSessions.ResultsToken,
    CountRequested = 10,
});


// this requests the prior page relative to the previous results
userSessions = await _sessionManagementService.QuerySessionsAsync(new SessionQuery
{
    ResultsToken = userSessions.ResultsToken,
    RequestPriorResults = true,
    CountRequested = 10,
});
```

### Terminating Sessions

[Section titled âTerminating Sessionsâ](#terminating-sessions)

To terminate session(s) for a user, use the `RemoveSessionsAsync` API. This accepts a `RemoveSessionsContext` which can filter on the subject and/or the session identifier to terminate. It then also has flags for what to terminate or revoke. This allows deleting a userâs session record in the store, any associated tokens or consents in the [operational database](/identityserver/data/operational/#grants), and/or notifying any clients via [back-channel logout](/identityserver/ui/logout/notification/#back-channel-server-side-clients) that the userâs session has ended. There is also a list of client identifiers to control which clients are affected.

An example to revoke everything for current sessions for subject id `12345` might be:

```csharp
await _sessionManagementService.RemoveSessionsAsync(new RemoveSessionsContext {
    SubjectId = "12345"
});
```

Or to just revoke all refresh tokens for current sessions for subject id `12345` might be:

```csharp
await _sessionManagementService.RemoveSessionsAsync(new RemoveSessionsContext {
    SubjectId = "12345",
    RevokeTokens = true,
    RemoveServerSideSession = false,
    RevokeConsents = false,
    SendBackchannelLogoutNotification = false,
});
```

Internally this uses the `IServerSideTicketStore`, `IPersistedGrantStore` and `IBackChannelLogoutService` features from IdentityServer.
-----