Revoke stale sessions after password change #649

Merged

alteixeira20 merged 2 commits from alteixeira20/harden-password-session-revocation into main

2026-06-01 20:15:35 +02:00

alteixeira20 commented

2026-06-01 18:58:49 +02:00

(Migrated from github.com)

Summary

Revokes other active browser sessions after a successful password change.

Changes

Add AuthManager.revoke_user_sessions(username, except_token=None).
Revoke other browser sessions for the same user after password change succeeds.
Preserve the current odysseus_session browser session.
Leave API-token behavior unchanged.
Add focused regression tests for session revocation and wrong-password behavior.

Motivation

If a user changes their password after suspecting stale or unwanted sessions, other browser sessions should not remain valid until expiry. This keeps password-change behavior safer while avoiding the UX surprise of logging out the current tab.

Validation

python3 -m py_compile core/auth.py routes/auth_routes.py tests/test_auth_session_revocation.py
python3 -m pytest tests/test_auth_session_revocation.py
git diff --check

Notes

Focused auth/session hardening only. API tokens are intentionally unchanged.

## Summary Revokes other active browser sessions after a successful password change. ## Changes - Add `AuthManager.revoke_user_sessions(username, except_token=None)`. - Revoke other browser sessions for the same user after password change succeeds. - Preserve the current `odysseus_session` browser session. - Leave API-token behavior unchanged. - Add focused regression tests for session revocation and wrong-password behavior. ## Motivation If a user changes their password after suspecting stale or unwanted sessions, other browser sessions should not remain valid until expiry. This keeps password-change behavior safer while avoiding the UX surprise of logging out the current tab. ## Validation - `python3 -m py_compile core/auth.py routes/auth_routes.py tests/test_auth_session_revocation.py` - `python3 -m pytest tests/test_auth_session_revocation.py` - `git diff --check` ## Notes Focused auth/session hardening only. API tokens are intentionally unchanged.

sleepy added the

bug

label

2026-06-01 20:00:39 +02:00

sleepy added 1 commit

2026-06-01 20:13:22 +02:00

Address review: add logging + missing test cases 9a7d4a8d99

sleepy merged commit 2a78bc873b into main

2026-06-01 20:15:35 +02:00

sleepy referenced this pull request from a commit

2026-06-01 20:15:35 +02:00

Revoke stale sessions after password change (#649)

sleepy commented

2026-06-01 20:15:36 +02:00

Owner

Merged via squash. Session revocation on password change with audit logging. 7 tests pass covering preserve-current, revoke-all, and zero-session paths.