# Auth0 does not create a session if one already exists

**URL:** <https://community.auth0.com/t/auth0-does-not-create-a-session-if-one-already-exists/80363>\
**Category:** Get Help\
**Created:** [March 22, 2022, 9:10pm UTC](https://community.auth0.com/t/auth0-does-not-create-a-session-if-one-already-exists/80363 "2022-03-22T21:10:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhull](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mhull/32/33662_2.png) [@mhull](https://community.auth0.com/u/mhull)\
**Post date:** [March 22, 2022, 9:10pm UTC](https://community.auth0.com/t/auth0-does-not-create-a-session-if-one-already-exists/80363/1 "2022-03-22T21:10:27Z")

</div>

- **Which SDK this is regarding:** e.g. auth0-react
- **SDK Version:** e.g. 1.9.0

We’ve come up with an interesting flow that I’m not sure what the expectations are. Essentially this boils down to user A being logged into our app and then user B logging in via alternate means, but on the same computer. The Auth0 SDK for react leaves the original user logged in.

More accurately:

- User A logs in with chrome
- User B uses our sign up form in Firefox on the same PC
- New User B gets a password reset/verification email and opens it in chrome
- User B completes the password reset process (now in chrome on the same PC) and is redirected back to our app by Auth0
- Our app calls `getTokenSilently` but recieves the cached token for User A

Should Auth0 be clearing out the session of the original user? Or is this a weird edge case?

We stumbled upon this while testing out a custom signup+password reset flow we put in place using password reset tickets.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 23, 2022, 10:37pm UTC](https://community.auth0.com/t/auth0-does-not-create-a-session-if-one-already-exists/80363/3 "2022-03-23T22:37:25Z")

</div>

Hi @mhull,

Welcome to the Auth0 Community!

> [@mhull](#):
>
> Should Auth0 be clearing out the session of the original user? Or is this a weird edge case?

I would say this is a weird edge case. IIRC, completing a password reset doesn’t create a new session, so this would be expected in the flow you described. The user would still have to log in after resetting their password if there wasn’t an existing session.

Additionally, I haven’t seen this come up as a common problem.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [April 21, 2022, 11:57pm UTC](https://community.auth0.com/t/auth0-does-not-create-a-session-if-one-already-exists/80363/4 "2022-04-21T23:57:32Z")

</div>