Development » Algonyx

Description¶

Module/Section: Agency → Create New Password
Profile: Agency
Issue Category: Functional

When a user is signed in on multiple browsers or devices, changing the password on one session does not invalidate active sessions on other browsers/devices.
Existing sessions remain authenticated due to valid cookies, even after the password is updated.

Steps to Reproduce¶

1. Sign in to the account on Browser A.
2. Sign in to the same account on Browser B.
3. On Browser A, change the account password successfully.
4. On Browser B, refresh the page or continue using the session.
5. Observe the session state on Browser B.

Expected Result¶

Upon password change, all active sessions on other devices must be invalidated.
Users should be prompted to choose whether to log out from all devices or maintain trusted sessions.

Actual Result¶

Active sessions on other devices remain authenticated and continue to function with the old session.

Attachments¶

• PoC

Impact Area:¶

Root Cause:¶

Additional Info¶

• Tested By: Aman