Tokens clear after Password reset

[sebfie]

Hello,

I was wondering about token invalidation after a password reset. In this scenario what happens :

Login to Your Account using firefox.

Now login to the same account using google chrome.

Let's assume the website user's account is compromised so he wants to change his password, he will navigate to forgot password page or simply password change page and will change his password in the Chrome browser(and the session in chrome is invalidated as well).

The web user is able to change his password and the session from which the password changes is logged out but it was observed that still the previous session in firefox is not invalidated and I was actually able to browse the website from both the sessions.

I think we should manage this right ?

Thank you.

[sojan-official]

seems like #1561