Unleash / unleash / 27275422119

87%

master: 91%

Build Type

push

github

Committed by web-flow

Commit Message

fix: invalidate other sessions on password change (#12262)

Changing a password now terminates the user's other active sessions
while keeping the session that performed the change alive, matching
OWASP session management guidance so a compromised account can lock out
an attacker on other devices.

- Add SessionService.deleteSessionsForUserExcept to drop all of a user's
sessions except a given one
- Thread a ChangePasswordOptions ({ logoutUser, keepSessionId }) object
through changePassword / WithPreviouslyUsedPasswordCheck /
WithVerification
- changeMyPassword passes the current req.sessionID so self-service
changes keep the current device logged in and sign out the rest
- Harden the logout opt-out to be secure-by-default: only an explicit
logoutUser: false skips invalidation

## About the changes

Closes #

### Important files

## Discussion points

## OSS PR checklist

- [x] I have read and agree to the [Unleash Contributor License
Agreement](https://github.com/Unleash/unleash/blob/main/CLA.md).
- [x] I have added tests or explained why tests are not needed.
- [x] I have updated documentation where relevant.

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Coverage Stats

1874 of 2068 branches covered (90.62%)

7 of 7 new or added lines in 3 files covered. (100.0%)

10 existing lines in 4 files now uncovered.

15206 of 17414 relevant lines covered (87.32%)

847.34 hits per line