Description: In my application, when I log in from multiple devices and initiate a password reset on one of them, the login sessions on other devices remain active, and the access token remains valid until it expires. It is not being invalidated.
While searching for a solution in the community forum, I came across this discussion:
[Invalidating an Access Token after User Logout]
I’m curious to understand why the access token isn’t invalidated. Even if we manage to terminate other sessions, the token remains valid, posing a significant security risk, as an attacker could continue accessing APIs until it expires.
I would like to understand this architecture better and find a solution to address this issue.