# Resetting password does not invalidate other sessions
**URL:** https://meta.discourse.org/t/resetting-password-does-not-invalidate-other-sessions/27454
**Category:** Bug
**Created:** [11 Abril , 2015 16:47 UTC](https://meta.discourse.org/t/resetting-password-does-not-invalidate-other-sessions/27454 "2015-04-11T16:47:24Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@loopback0](https://meta.discourse.org/u/loopback0)
#### Post date: [11 Abril , 2015 16:47 UTC](https://meta.discourse.org/t/resetting-password-does-not-invalidate-other-sessions/27454/1 "2015-04-11T16:47:25Z")
If you’re logged in to multiple browsers, and trigger a password reset from one of them, after you’ve set the new password the other browsers remain logged in.
The better practice is to invalid any sessions established under a set of credentials when those change.
Imagine someone else compromises your account and changes your password, but your session is still active so you don’t know anything’s happened. If the session was invalidated once they changed it, you’d try and log back in and know straight away.
This is also inconsistent from clicking “Log Out” which does invalid the other sessions.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [11 Abril , 2015 19:24 UTC](https://meta.discourse.org/t/resetting-password-does-not-invalidate-other-sessions/27454/2 "2015-04-11T19:24:58Z")
Yes good point, @sam we should add this to our list for when you are back.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [14 Abril , 2015 23:06 UTC](https://meta.discourse.org/t/resetting-password-does-not-invalidate-other-sessions/27454/3 "2015-04-14T23:06:09Z")
Fixed via:
[https://github.com/discourse/discourse/commit/2a3f71a9a1717c420c047dc379d3367858c82391](https://github.com/discourse/discourse/commit/2a3f71a9a1717c420c047dc379d3367858c82391)
backported to beta and stable
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [14 Abril , 2015 23:06 UTC](https://meta.discourse.org/t/resetting-password-does-not-invalidate-other-sessions/27454/4 "2015-04-14T23:06:14Z")