Session cookies survived a password reset

The reset form updated users.password_hash. It did not rotate sessions.token. A session issued at login still authenticated /account 20 minutes after the password change.

What we ran

$ curl -sI -X POST https://app.example/reset --data email=ada@example.com
HTTP/1.1 204 No Content
$ curl -sI https://app.example/account --cookie session=kept-after-reset
HTTP/1.1 200 OK

What the handler did

if path == "/reset":
    user.password_hash = hash(new_password)
    db.commit()
    # sessions table left untouched

The cookie Max-Age was 1,209,600 seconds (14 days). The reset token TTL was 3,600 seconds. The longer of the two survived.

Fix we asked for

Revoke server-side sessions on password change. Make session lifetime shorter than the reset-token window. Record a timestamp and a request id in the change log.