Bug report: when you change user password, all other sessions still opens with previous password

Question

Hi There,

I've changed a user password in one of the browsers. This user is still active with previous passwords in other browsers

Answer 1

If I understand what you're describing correctly, this is not a bug.

When you say you're still logged in "with previous passwords" that's not really the case. You're not actually using your previous password in the other browser, you're using a session. The session was originally verified with the old password, but it's not using the password now in any way.

Comments

Thanks Scott for the point mentioned. Anyways, I would say, from security stand point it would be better to end other sessions if password is changed or any  other solutions so that other sessions with previous password would be killed.