Repository: gradio-app/gradio
File: gradio/routes.py (Python)

Code before:
                    httponly=True,
                    samesite="none",
                    secure=True,
                )
                response.set_cookie(
                    key=f"access-token-unsecure-{app.cookie_id}",
                    value=token,
                    httponly=True,
                )
                return response
            else:
                raise HTTPException(status_code=400, detail="Incorrect credentials.")

        ###############
        # OAuth Routes
        ###############

        # Define OAuth routes if the app expects it (i.e. a LoginButton is defined).
        # It allows users to "Sign in with HuggingFace". Otherwise, add the default
        # logout route.
        if app.blocks is not None and app.blocks.expects_oauth:
            attach_oauth(app)
        else:

            @app.get("/logout")
            def logout(request: fastapi.Request):
                root = route_utils.get_root_url(
                    request=request,
                    route_path="/logout",
                    root_path=app.root_path,
                )
                response = RedirectResponse(url=root, status_code=status.HTTP_302_FOUND)
                response.delete_cookie(key=f"access-token-{app.cookie_id}", path="/")
                response.delete_cookie(
                    key=f"access-token-unsecure-{app.cookie_id}", path="/"
                )
                # Delete only the token associated with the current cookie.
                del app.tokens[request.cookies.get(f"access-token-{app.cookie_id}")]
                return response

        ###############
        # Main Routes
        ###############

        @app.get("/svelte/{path:path}")
        def _(path: str):
            svelte_path = Path(BUILD_PATH_LIB) / "svelte"
            return FileResponse(
                routes_safe_join(
                    DeveloperPath(str(svelte_path)), UserProvidedPath(path)
                )

Review comment (suggestion):
Hi @tarmkalavan ! Thanks for the PR. This would be a breaking change. Instead, let's keep the current behavior but let's add a query parameter called `all_sessions` with default value true. If it's set to False, then only the current session is deleted.

Code after:
                    httponly=True,
                    samesite="none",
                    secure=True,
                )
                response.set_cookie(
                    key=f"access-token-unsecure-{app.cookie_id}",
                    value=token,
                    httponly=True,
                )
                return response
            else:
                raise HTTPException(status_code=400, detail="Incorrect credentials.")

        ###############
        # OAuth Routes
        ###############

        # Define OAuth routes if the app expects it (i.e. a LoginButton is defined).
        # It allows users to "Sign in with HuggingFace". Otherwise, add the default
        # logout route.
        if app.blocks is not None and app.blocks.expects_oauth:
            attach_oauth(app)
        else:

            @app.get("/logout")
            def logout(
                request: fastapi.Request,
                user: str = Depends(get_current_user),
                all_session: bool = True,
            ):
                root = route_utils.get_root_url(
                    request=request,
                    route_path="/logout",
                    root_path=app.root_path,
                )
                response = RedirectResponse(url=root, status_code=status.HTTP_302_FOUND)
                response.delete_cookie(key=f"access-token-{app.cookie_id}", path="/")
                response.delete_cookie(
                    key=f"access-token-unsecure-{app.cookie_id}", path="/"
                )
                if all_session:
                    # Delete the tokens of all sessions associated with the current user.
                    for token in list(app.tokens.keys()):
                        if app.tokens[token] == user:
                            del app.tokens[token]
                # Delete only the token associated with the current session.
                elif request.cookies.get(f"access-token-{app.cookie_id}") in app.tokens:
                    del app.tokens[request.cookies.get(f"access-token-{app.cookie_id}")]
                return response

        ###############