# Behavior after password change **URL:** \ **Category:** Get Help\ **Tags:** reset-password-prompt-new-experience, login-experience\ **Created:** [June 7, 2025, 10:19am UTC](https://community.auth0.com/t/behavior-after-password-change/187725 "2025-06-07T10:19:38Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![figureouter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/figureouter/32/70936_2.png) [@figureouter](https://community.auth0.com/u/figureouter)\ **Post date:** [June 7, 2025, 10:19am UTC](https://community.auth0.com/t/behavior-after-password-change/187725/1 "2025-06-07T10:19:38Z")
I’m really confused what happens after password reset. I have React and Express applications in my tenant. In my React, I have password reset button, which sends a link to an email containing password reset flow. Now, after user resets their password, what happens after that? If I have two browser instances with the same logged in user, how do I manage to log out both of them? What’s the best practice there? Or why do I have to do this myself, why it’s not already implemented? Logically, it’s mandatory to log user out everywhere after password reset. ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [June 10, 2025, 6:04pm UTC](https://community.auth0.com/t/behavior-after-password-change/187725/3 "2025-06-10T18:04:51Z")
Hi @figureouter Welcome to the Auth0 Community! When the user resets their password through a link such as a [password change ticket](https://auth0.com/docs/api/management/v2/tickets/post-password-change), the user’s sessions are all invalidated across devices/browsers and they should be asked to re-authenticate. If you have any other questions, let me know! Kind Regards, Nik ---
**Author:** ![figureouter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/figureouter/32/70936_2.png) [@figureouter](https://community.auth0.com/u/figureouter)\ **Post date:** [June 10, 2025, 6:41pm UTC](https://community.auth0.com/t/behavior-after-password-change/187725/4 "2025-06-10T18:41:06Z")
I’m doing like this ```auto const response = await fetch(`https://${DOMAIN}/dbconnections/change_password`, { method: 'POST', headers: { "Content-Type": "application/json", "Accept": "application/json", }, body: JSON.stringify({ "client_id": CLIENT_ID, "email": user.email, "connection": 'Username-Password-Authentication', }), redirect: 'follow' }); ``` It emails a link and I successfully change the password. But it doesn’t log me out when I refresh my tab inside the browser. ---
**Author:** ![figureouter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/figureouter/32/70936_2.png) [@figureouter](https://community.auth0.com/u/figureouter)\ **Post date:** [June 12, 2025, 1:15pm UTC](https://community.auth0.com/t/behavior-after-password-change/187725/5 "2025-06-12T13:15:04Z")
Hey nik. Can you reply to my latest question? Thanks. ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [June 12, 2025, 2:36pm UTC](https://community.auth0.com/t/behavior-after-password-change/187725/6 "2025-06-12T14:36:39Z")
Hi again! I am sorry about the delayed response. I have tested using one of our sample applications and using multiple browsers. After the user was logged in on both Chrome and Firefox, I have submitted a cURL request for the password change email, the same as you have used above and the users sessions have been both terminated and asked to log in again. I believe that your application might be persisting the application session of the user after they got terminated due to the password change or their session is being refreshed. I would recommend to check your logs to see if any kind of silent authentication is performed after the password has been changed for the user. Let me know if I can help with anything else on the matter and what are your findings in the logs! Kind Regards, Nik ---
**Author:** ![figureouter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/figureouter/32/70936_2.png) [@figureouter](https://community.auth0.com/u/figureouter)\ **Post date:** [June 12, 2025, 2:51pm UTC](https://community.auth0.com/t/behavior-after-password-change/187725/7 "2025-06-12T14:51:50Z")
Thank you nik for your time! I’ve observed that the reason is `cacheLocation='localstorage'` which I’m setting on `Auth0Provider` inside my React app. when I remove this line, it works pretty well. I’m using this because without it my application is pretty slow as it has to get access token every time I visit some page. Is there any way to solve both problems? Like keeping my application fast when retrieving access token with `getAccessTokenSilently` (like with local storage) and log user out after password reset. Thanks. ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [June 12, 2025, 3:43pm UTC](https://community.auth0.com/t/behavior-after-password-change/187725/8 "2025-06-12T15:43:57Z")
Hi again. Regarding this matter, I believe the following community post will be helpful: > [@Check auth0 session when React SPA starts](https://community.auth0.com/t/check-auth0-session-when-react-spa-starts/122350): > > Hey, I am trying to solve this issue: I have 2 applications. One of them is React SPA (I am using @auth0/auth0-react). In this SPA, I am using localStorage to store user info in browser and I am using refresh tokens (not sure if this is relevant). If I log out in my other app, the localStorage in my SPA if not cleared (of course). Problem: When user then visits my SPA, he is still logged in. rotating_light I somehow need to check when SPA starts, that auth0 session is valid. Since there is … Otherwise, I would recommend to either check the user session by using the `isAuthenticated()` method available within the SDK as mentioned in the above post or to provide a prompt to the user that by requesting the reset password email they will be logged out - if they accept, the email will be sent and the user will be logged out so that they are forced to re-authenticate. If I can help with anything else, let me know! Kind Regards, Nik ---
**Author:** ![figureouter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/figureouter/32/70936_2.png) [@figureouter](https://community.auth0.com/u/figureouter)\ **Post date:** [June 13, 2025, 9:03pm UTC](https://community.auth0.com/t/behavior-after-password-change/187725/9 "2025-06-13T21:03:04Z")
Hi nik, what do you mean by forcing user to log out? Won’t this method log out only the person trying to reset the password? And not the possible attacker logged in another place? ---
**Author:** ![figureouter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/figureouter/32/70936_2.png) [@figureouter](https://community.auth0.com/u/figureouter)\ **Post date:** [June 17, 2025, 1:30pm UTC](https://community.auth0.com/t/behavior-after-password-change/187725/10 "2025-06-17T13:30:20Z")
Can you respond nik? Also, if an old access token is still valid after password reset, what’s the point of logging out? ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [June 18, 2025, 4:39pm UTC](https://community.auth0.com/t/behavior-after-password-change/187725/11 "2025-06-18T16:39:03Z")
Hi, I am sorry about the delayed response. By logging out I am referring to either redirect the user to the `/logout` endpoint for their current session, meaning that an attacker would get logged out but the user’s session on their device would remain uninterrupted. Alternatively, you can also terminate all of their sessions on password reset request as documented [here](https://auth0.com/docs/api/management/v2/users/delete-sessions-for-user). I would recommend the first approach if you are retrieving the access token frequently in order to persist the session. > Also, if an old access token is still valid after password reset, what’s the point of logging out? In this scenario, I would recommend to have access tokens with a short lifespan and extend the user’s session by using refresh tokens. However, if you are using `isAuthenticated()`, you would retrieve the access token only if the user has a session valid, meaning that if they will be logged out after asking for a password reset in your scenario, the access token will not be retrieved because `isAuthenticated()` will return `false`. Kind Regards, Nik ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [July 2, 2025, 4:39pm UTC](https://community.auth0.com/t/behavior-after-password-change/187725/12 "2025-07-02T16:39:55Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.