Scenario: If a User has logged in two browsers and if he reset password in one browser, the second browser session is still active. this will be a problem if an attacker gains access to my account and even after I reset my password, attacker will have access to my account till my session is timed out. any ideas on how to invalidate all active sessions once user has reset his password.
2
-
You can't automatically detect that a password has been changed, much less kill all existing sessions automatically. If you have any sessions you're worried about, you can kill them individually as mentioned in the answer.– sfdcfox ♦Commented Jul 6, 2021 at 1:00
-
Thanks for the reply. I was actually looking to see if there is a way to automate this functionality. But there is no option to identify password reset event– Veera GCommented Jul 6, 2021 at 7:45
Add a comment
|
1 Answer
You can see all active sessions and session details on the User Session Information page.
Setup --> Session Management
From here, you can view information about or delete active user sessions. As noted in the doc linked above:
When you manually end a user’s session by clicking the Remove button, the user must log in again to the organization.
You can create your own "views" which you can filter by username to easily select all sessions and remove all.
answered Jul 5, 2021 at 22:31
