ASVS 5.0 V7.4.3 (Level 2) requires that after a successful change or removal of an authentication factor, including a password change through reset or recovery and any MFA settings update, the application offers the user the option to end all other active sessions.
Why it matters
People change passwords because they suspect a problem. If the attacker's session survives the change, the reset accomplished nothing. Giving the choice, ideally with a safe default, closes that gap.
How to implement it
After the credential change succeeds, keep the current session (rotating its token, see V7.2.4) and show a clear option such as "Sign out of all other devices". Pre check it for password resets and recovery, where compromise is likely.
app.post("/account/password", requireSession, async (req, res) => {
await changePassword(req.user.id, req.body.newPassword);
const keepOthers = req.body.keepOtherSessions === "true";
const newSid = await rotateSession(req);
if (!keepOthers) {
await db.sessions.updateMany(
{ userId: req.user.id, id: { $ne: newSid } },
{ $set: { revoked: true } }
);
}
res.redirect("/account?saved=1");
});
Apply the same pattern to adding or removing an MFA device, changing a recovery email, and finishing an account recovery flow. Send an email notice listing what changed and when.
How to test it
- Sign in from browsers A and B.
- In browser A, change the password and tick the option to end other sessions.
- Confirm browser B is rejected on its next request while A stays signed in on a fresh token.
- Repeat for MFA enrollment changes and for the recovery path.
Common mistakes
- Offering the choice only on password change, not on MFA changes.
- Revoking the current session too, which frustrates users.
- Forgetting refresh tokens and API tokens tied to the old credential.
Quick check
Must the other sessions always be ended?
The requirement is to give the option. Making it the default after resets and recovery is sensible practice.
