0

I need help regarding WordPress session management. Follow these steps::

Bug: Session management and break authentication.

Steps to reproduce:

  1. Log in to your account using browser 1.

  2. Now, login to the same account using browser 2.

  3. Change the password in browser 1.

  4. Refresh in the browser 2 nothing will happen account remains logged in.

If this bug is not present than account must log out automatically when the browser 2 is refreshed.

It is a medium severity bug. What will be the solution? Thanks

2
  • I don't think this is a bug, because you have authenticated before and WordPress stores an authentication cookie, to check if you're logged in. Changing your password doesn't force you out if you're logged in on another client. See: codex.wordpress.org/WordPress_Cookies Commented Jan 10, 2019 at 6:34
  • PS: I understand your point and it seems to be more like a feature request. You should report it here: core.trac.wordpress.org Commented Jan 10, 2019 at 6:38

1 Answer 1

2

I have gone through the above case. I have checked when you change password you will have the option of logout every where else. So you need to check it. https://www.screencast.com/t/0tilp5u2

I will explain it the reason for the same. In this when you login into wordpress.The details are saved in the form of cookies into your browser in form of sessions. However on selecting above button you will be clearing all the session of the website.

If you do not do it there will be session on the system so you will not be logged out on another browser

4
  • 1
    Yes @pratik that is the good way to fix this kind of issue. Commented Jan 10, 2019 at 7:02
  • Yeah, I didn't know this was an option. I apologize. I have deleted my answer. Commented Jan 10, 2019 at 8:02
  • if customer is changing password this may be issued.
    – Johnthan
    Commented Jan 10, 2019 at 10:21
  • What do you mean by customer? Is it for woocommerce? @Johnthan Commented Jan 10, 2019 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.