Do you auto logout after password change

[vinpkl]

hi all

Do you make your clients auto logout immediately after they change password ??

vineet

[kduv]

That's really your choice. How do you want your site to work?

[jestep]

What would the benefit, security or otherwise, for forcing a re-login? They've already authenticated, so it seems like an unnecessary inconvenience under normal circumstances.

[felgall]

I can't see any benefit in forcing them to enter the new password a third time straight after entering it the first two times.

I do require that the old password be re-entered when entering a new password even though they are already logged in - so as to prevent someone else changing their password if they leave the session unattended.

[TomB]

I can't see any benefit in forcing them to enter the new password a third time straight after entering it the first two times.

I do require that the old password be re-entered when entering a new password even though they are already logged in - so as to prevent someone else changing their password if they leave the session unattended.

I agree. I also think it's a good idea to force a password entry to update their email address. Otherwise someone could change the email address and then use 'Forgot password' to reset it, gaining access to the account without ever knowing the password.

[Wisestepp]

I want the php code for clients auto logout immediately after they change password

[logic_earth]

I want the php code for clients auto logout immediately after they change password

Everyone would want a lot of things, but we rarely get them when we demand. Please see: Manners.

[Lemon Juice]

Do you make your clients auto logout immediately after they change password ??

Not on the computer (session) they have just entered the new password. But if I have an auto-login feature - a "remember me" checkbox so that the user's session cookie is stored for a longer period of time on his computer then there may be a situation where he has open sessions on many computers. After changing his password I always invalidate all those sessions except the current one. I think this is important if someone changes their password because of unauthorised access suspicion - they will want to be sure that no one can access their account without entering the new password first.