Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

alturic's avatar

Session Invalidation, Redis Sessions

I asked this in #laravel and it appears as though (what seems like a rather common security practice and according to some replies in #laravel) Laravel hasn't implemented a default session invalidation when a user changes their password? I'm pretty sure using database as the driver, it would be easy enough to get all User's sessions and then invalidate manually however?

Secondly, when using redis as the session driver, I presume Laravel loses all knowledge of session tracking at this point? What would be the best solution to solve the issue above, where User changes his password, since the actual User has now changed, invalidate any previous sessions for the User?

0 likes
1 reply

Please or to participate in this conversation.