Why does is_user_logged_in() return false after I change user password on the front end?

Question

I've written a custom front-end change password page. At the top of the page I have this snippet of code:

<?php if ( !is_user_logged_in() ) { auth_redirect(); } ?>   

After the request is processed and the user's password is changed the page draws, but the next page view triggers is_user_logged_in() to return false and it sends the user to the login page... After looking at the code for is_user_logged_in() I'm guessing that something gets invalidated in the user's cookie, but I have no idea what.

Any pointers?

Answer 1

The login cookie is named 'wp-postpass_' . COOKIEHASH where COOKIEHASH is either defined in your wp-config.php or in wp-includes/default-constants.php function wp_cookie_constants().

The value is:

$hasher->HashPassword( wp_unslash( $_POST['post_password'] ) )

Whenever the password is changed, the cookie doesn’t match anymore, and is_user_logged_in() must return FALSE.

Send your users to the login screen immediately after they changed the password.
Or authenticate the user after the password saving:

require_once ABSPATH . 'wp-includes/class-phpass.php';
$hasher = new PasswordHash( 8, true );
$expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH );

Answer 2

It feels odd answering my own question (should this be a new question?), but after reading this question I found the following code snippet that changed the behavior:

//action hook for plugins and extra fields saving                          
do_action('edit_user_profile_update', $current_user->ID);
wp_redirect( get_permalink() );
exit();

I added this after my call to wp_update_user() and is_user_logged_in no longer returns false. Why is this?