Destroy logged in sessions after successfully password reset

[nsinelnikov]

There is wp-login.php form popup if the session is expired in wp-admin. But for the frontend part there can be this enhancement:

1. Go to Browser A and log in with your credentials.

2. Go to Browser B (it can be a public device) and log in with your credentials again.

3. Go back to Browser A and change or reset your password.

4. After a successful reset/change of a password in Browser A, the session in Browser B should be destroyed and the user should automatically be logged out.

Destroyed user's sessions using WP_Session_Tokens class.

Trac ticket: https://core.trac.wordpress.org/ticket/58911

[rajinsharwar]

Hi @nsinelnikov, thanks for the Ticket. The user in Browser A will be forced to log in after the password reset is initiated from Browser B, even without the patch you attached. The reason is, we are checking if the password was changed or not, and then use the wp_clear_auth_cookie() function to reset any cookie related to authentication.
​https://developer.wordpress.org/reference/functions/wp_clear_auth_cookie/

Your contribution is more than welcome. But, as this functionality is already in the core, I will be closing this ticket for now with the resolution of "worksforme"