user appears to be logged out when password is updated (fortify)
Hi there !
in my single page application, after updating user password with fortify route PUT /user/password user appears to be logged out when requesting server again (Laravel 11).
My investigation :
In my App\Actions\Fortify\UpdateUserPassword, if I remove the line 'password' => Hash::make($input['password']), the user still logged in and he can request server again as a logged user (but of course password is not updated).
So I assume the password is "linked" to the user session and when we update it, the session is not valid anymore ?
(I tried to update config file hashing.php with 'rehash_on_login' => false, but this does not solve the problem)
Steps To Reproduce (using laravel fortify) :
I log in a user
I call route PUT /user/password
I call any other route of my application that need to be logged in
@jpp_laravel Yes, sessions will be invalidated if the password is changed.
Imagine someone has discovered your password and logged in on another device. It would be a bit rubbish if you changed your password from your device but it didn’t log the bad actor out of your account on their device.