Password change and session invalidate

peopleinside

Hi, if a password of user is changed but access was active on more device, will be the user logout from all device?
In what I can see maybe not.

I reset the password from a PC where I was not authenticate and than when i turn on 2 PC where I was authenticate I don't need to sign in again.

If user password is changed, for security reason, all session should be invalidated, this is useful for protect the account.

luceos

I don't think that happens (https://discuss.flarum.org/d/22642-security-roadmap). You could remove the remember tokens in the database table access_tokens for that specific user.

peopleinside

On what I seen, if remember me was checked and password is changed other access will be not closed with logout but seems account still be accessible. I tried to test in beta but as no email are sent I cannot test more on demo.