0

I need help regarding WordPress session management. Follow these steps::

Bug: Session management and break authentication.

Steps to reproduce:

  1. Log in to your account using browser 1.

  2. Now, login to the same account using browser 2.

  3. Change the password in browser 1.

  4. Refresh in the browser 2 nothing will happen account remains logged in.

If this bug is not present than account must log out automatically when the browser 2 is refreshed.

It is a medium severity bug. What will be the solution? Thanks

2
  • I don't think this is a bug, because you have authenticated before and WordPress stores an authentication cookie, to check if you're logged in. Changing your password doesn't force you out if you're logged in on another client. See: codex.wordpress.org/WordPress_Cookies – Remzi Cavdar Jan 10 '19 at 6:34
  • PS: I understand your point and it seems to be more like a feature request. You should report it here: core.trac.wordpress.org – Remzi Cavdar Jan 10 '19 at 6:38
2

I have gone through the above case. I have checked when you change password you will have the option of logout every where else. So you need to check it. https://www.screencast.com/t/0tilp5u2

I will explain it the reason for the same. In this when you login into wordpress.The details are saved in the form of cookies into your browser in form of sessions. However on selecting above button you will be clearing all the session of the website.

If you do not do it there will be session on the system so you will not be logged out on another browser

4
  • 1
    Yes @pratik that is the good way to fix this kind of issue. – Tejas Gajjar Jan 10 '19 at 7:02
  • Yeah, I didn't know this was an option. I apologize. I have deleted my answer. – Remzi Cavdar Jan 10 '19 at 8:02
  • if customer is changing password this may be issued. – Johnthan Jan 10 '19 at 10:21
  • What do you mean by customer? Is it for woocommerce? @Johnthan – Pratik bhatt Jan 10 '19 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.