Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

jpp_laravel's avatar

user appears to be logged out when password is updated (fortify)

Hi there !

in my single page application, after updating user password with fortify route PUT /user/password user appears to be logged out when requesting server again (Laravel 11).

My investigation :

In my App\Actions\Fortify\UpdateUserPassword, if I remove the line 'password' => Hash::make($input['password']), the user still logged in and he can request server again as a logged user (but of course password is not updated). So I assume the password is "linked" to the user session and when we update it, the session is not valid anymore ?

(I tried to update config file hashing.php with 'rehash_on_login' => false, but this does not solve the problem)

Steps To Reproduce (using laravel fortify) :

  • I log in a user
  • I call route PUT /user/password
  • I call any other route of my application that need to be logged in
  • I receive a 401 response

thank you for your help :)

0 likes
3 replies
martinbean's avatar
Level 80

@jpp_laravel Yes, sessions will be invalidated if the password is changed.

Imagine someone has discovered your password and logged in on another device. It would be a bit rubbish if you changed your password from your device but it didn’t log the bad actor out of your account on their device.

jpp_laravel's avatar

@martinbean thanks for your response!

That make sense, but I had the same mechanism in another project with laravel 10, and it didn't have this behaviour, the user remained logged in.

is it a security improvement in laravel 11 ?

Please or to participate in this conversation.