Repository navigation
Session revocation support for password reset - #775
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
This was referenced Oct 21, 2026
Collaborator
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
This was referenced Oct 21, 2026
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 21, 2026 14:23
d5cea90 to
1eee202
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 21, 2026 14:23
1053d64 to
3f34310
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 21, 2026 16:39
3f34310 to
ff30c70
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 21, 2026 16:39
1eee202 to
cfcad24
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
2 times, most recently
from
October 21, 2026 20:00
2f66a76 to
05b232b
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 21, 2026 20:13
cfcad24 to
4d4fd08
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 21, 2026 20:13
05b232b to
563beea
Compare
commit: |
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 21, 2026 20:14
563beea to
84b13df
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 21, 2026 20:16
4d4fd08 to
bc370db
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 21, 2026 20:44
84b13df to
a0050d9
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 21, 2026 20:44
bc370db to
4257917
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 21, 2026 21:31
4257917 to
2cb5e9a
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 26, 2026 23:27
fd53cdb to
e748bfc
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 26, 2026 23:44
e748bfc to
d83ad7c
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 26, 2026 23:44
201b3bd to
957d13b
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
2 times, most recently
from
October 26, 2026 23:50
520e0ba to
2a03112
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 26, 2026 23:51
d83ad7c to
2a88e48
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 27, 2026 14:51
2a88e48 to
a07384a
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 27, 2026 14:51
2a03112 to
adf014c
Compare
dowski
changed the base branch from
dowski/revoke-session-handle
to
graphite-base/775
October 27, 2026 15:00
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 27, 2026 15:01
a07384a to
914dafc
Compare
dowski
force-pushed
the
graphite-base/775
branch
from
October 27, 2026 15:01
adf014c to
09915cc
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 27, 2026 15:02
914dafc to
dbe6bb8
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 27, 2026 15:32
dbe6bb8 to
da882d6
Compare
Nicolapps
approved these changes
Oct 27, 2026
| args: { | ||
| currentPassword: v.string(), | ||
| newPassword: v.string(), | ||
| signOutOtherSessions: v.optional(v.boolean()), |
Member
There was a problem hiding this comment.
What do you think about making this default to false?
Pilcrow says the following about this:
Whether auth sessions should be invalidated after a user updates their password is a separate discussion. My personal view is that it's a good idea to ask users whether they want to sign out of all devices immediately after changing their password, but it shouldn't be mandatory. Users often update their password because they've forgotten it or simply as a preventative measure. It's also uncommon to invalidate existing sessions when passkeys are registered or removed. If you do choose to invalidate all sessions after a password change, always make that clear so users aren't left guessing.
| font-size: 1rem; | ||
| } | ||
|
|
||
| input[type="checkbox"] { |
Member
There was a problem hiding this comment.
What is this style doing? Fixing the margins?
Collaborator
Author
There was a problem hiding this comment.
The styles above for input make it a block element and set widths. This makes it so the checkbox and its label can be on the same line beside each other and not horizontally centered.
dowski
force-pushed
the
dowski/revoke-sessions-on-password-reset
branch
from
October 28, 2026 13:51
da882d6 to
ae2305e
Compare
This was referenced Nov 2, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a user resets their password, there's now optional support for revoking their other sessions. An app can choose to present a UI to give the user the choice or set its own value.