# Best practice: How to kick newly blocked users out of active sessions

**URL:** <https://community.auth0.com/t/best-practice-how-to-kick-newly-blocked-users-out-of-active-sessions/129802>\
**Category:** Get Help\
**Tags:** sessions, logout\
**Created:** [March 15, 2024, 9:06pm UTC](https://community.auth0.com/t/best-practice-how-to-kick-newly-blocked-users-out-of-active-sessions/129802 "2024-03-15T21:06:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![misley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/misley/32/51626_2.png) [@misley](https://community.auth0.com/u/misley)\
**Post date:** [March 15, 2024, 9:06pm UTC](https://community.auth0.com/t/best-practice-how-to-kick-newly-blocked-users-out-of-active-sessions/129802/1 "2024-03-15T21:06:56Z")

</div>

We’re looking to disable the UI of our application if we block a user in auth0. Right now, we only know if the user is blocked when they attempt to log in. What are some methods you recommend for checking user/org metadata in auth0 without hitting the api rate limits by checking each user on each page load? What’s the best way to store user metadata that changes often? Should we store it outside of auth0?

Thanks.

---

<div class="post-metadata">

**Author:** ![marcelina.barycka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcelina.barycka/32/56162_2.png) [@marcelina.barycka](https://community.auth0.com/u/marcelina.barycka)\
**Post date:** [March 18, 2024, 1:19pm UTC](https://community.auth0.com/t/best-practice-how-to-kick-newly-blocked-users-out-of-active-sessions/129802/3 "2024-03-18T13:19:29Z")

</div>

Thank you for posting @misley !

I’m happy to assist you in discovering the solution you’re looking for.

If we are looking for an answer to how to end a user session on the Auth0 (IdP) layer, this session is invalidated once a user is blocked.

To invalidate a local application session (the UI you are mentioning), there is a way for that as well (that shouldn’t cause you troubles with rate limiting if we follow the recommended 15-minutes interval between calls) - please take a look at this [doc](https://community.auth0.com/t/does-blocking-a-user-end-their-session/117905), especially the part:

> If needed to log users out of the application’s local session when blocking them, it is necessary to periodically poll the `/authorize` endpoint using the “prompt=none” parameter (AKA silent authentication) to check if the user still has a valid session on the Auth0 side.

- Check out [Poll with checkSession()](https://auth0.com/docs/authenticate/login/configure-silent-authentication#poll-with-checksession-).

Please let us know your thoughts and follow-up questions!

---

<div class="post-metadata">

**Author:** ![misley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/misley/32/51626_2.png) [@misley](https://community.auth0.com/u/misley)\
**Post date:** [March 18, 2024, 6:06pm UTC](https://community.auth0.com/t/best-practice-how-to-kick-newly-blocked-users-out-of-active-sessions/129802/4 "2024-03-18T18:06:51Z")

</div>

Thanks for the reply. Is there a similar process for getting latest app\_metadata? Or do we need to rely on regular API hits for that?

---

<div class="post-metadata">

**Author:** ![marcelina.barycka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcelina.barycka/32/56162_2.png) [@marcelina.barycka](https://community.auth0.com/u/marcelina.barycka)\
**Post date:** [March 20, 2024, 12:52pm UTC](https://community.auth0.com/t/best-practice-how-to-kick-newly-blocked-users-out-of-active-sessions/129802/5 "2024-03-20T12:52:33Z")

</div>

You’re welcome @misley !

> [@misley](#):
>
> Is there a similar process for getting latest app\_metadata? Or do we need to rely on regular API hits for that?

You can also use [Actions to get the app\_metadata](https://auth0.com/docs/manage-users/user-accounts/metadata/manage-user-metadata) and make login decisions based on them, an example:

```auto
exports.onExecutePostLogin = async (event, api) => {
  if (event.user.app_metadata.didAnExpensiveTask) {
    console.log(`Skipping the expensive task because it already occurred for ${event.user.email}.`);
    return;
  }
  // do and expensive task
  api.user.setAppMetadata("didAnExpensiveTask", true);
};

```

Hope this helps! Please let us know if you have any questions.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [April 3, 2024, 12:53pm UTC](https://community.auth0.com/t/best-practice-how-to-kick-newly-blocked-users-out-of-active-sessions/129802/6 "2024-04-03T12:53:25Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.