How destroy specific user session when we are using default php session handler?

Question

If a user A and a user B are both super user and the user A removes the super user permission of the user B, and the user B is logged in, while the user B session remain active, he can do anything on the system including recover his super user permission.

Update

Looking at the JUser::authorise method, we can see something like this:

public function authorise($action, $assetname = null)
{
    // Make sure we only check for core.admin once during the run.
    if ($this->isRoot === null)
    {
        //check if the user is root
    }

    return $this->isRoot ? true : JAccess::check($this->id, $action, $assetname);
}

So, if the user get logged in as super user, the JUser object in the session will have the isRoot property as true and the authorise method will always return true without check the current permission in database.

OBS: JFactory:getUser() return the JUser in session

Answer 1

Imho the only way would be to delete the session in the database (#__session table).

Then the user is forced to log in again and the permissions are calculated fresh.

UPDATE: As the comment below, there is no "joomla way" to destroy the session if we are using JSessionStorageNone. So, you likely have to wait till that users session times out or he logs out himself.