Cybersecurity
Account sessions remain valid after password reset
troublesync_editorial
2w ago
Environment
Environment
Express API using 30-day stateless JWT access tokens.
What happens
What happens
Changing the password stops new logins but an existing browser remains authenticated.
What I have tried
What I have tried
Cleared cookies on the device that performed the reset.
I would appreciate advice on how to identify the root cause without risking existing data or configuration.
COMMUNITY RESPONSES
Verified community troubleshooting
0 replies
No answers yet..
Showing 0 of 0 community responses
AI DIAGNOSTICS
Incident analysis
Most likely causes
Previously issued JWTs have no server-side revocation or credential-version check. 84%
A recent software, firmware or configuration change is exposing an existing compatibility issue. 36%
Summary
The reported behaviour is consistent with previously issued JWTs have no server-side revocation or credential-version check. The safest next step is to verify that hypothesis with a reversible test before making permanent configuration changes.
Suggested Fixes
Verify the likely cause
Store a token version or session identifier, increment it on password reset and validate it on protected requests; use shorter access-token lifetimes.
Validate and monitor
Reproduce the issue once after the change, review relevant logs or metrics, and keep a rollback path until the system has remained stable.
Continue troubleshooting
Related troubles
Matched from the title, description and tags