Add way to invalidate other sessions when the user changes their password.

Is your feature request related to a problem? Please describe. We’re implementing a custom forgot password flow on our web app and, while changing the password works fine, I would’ve expected other sessions to be invalidated. We have a mobile app that goes along with the web app and the mobile app stays logged in.

Describe the solution you’d like I would like a way to be able to invalidate other sessions after the user changes their password via the forgot password Auth flow. We call Auth.forgotPassword to send the user the verification code, and Auth.forgotPasswordSubmit with their username, verification code, and new password already. An additional optional parameter on forgotPasswordSubmit would be nice to indicate we want to invalidate other sessions.

Describe alternatives you’ve considered I considered using Auth.signOut({ global: true }), but that requires the user being signed into the app in the first place; the forgot password flow only applies when the user is already signed out on the local session in our app.

[jerocosio]

Hey @elorzafe, thanks for the quick reply. I actually use the global signout flag on my app, but I believe that even this would allow the attacker to have access at least until the refresh token expires, right? And the minimum time for the refresh tokens is 60 minutes, so the attacker could still have access for the account on this time.

[jerocosio]

Hello @elorzafe, I’m currently sending an e-mail to my users whenever there’s a password reset, I’m doing this with a Cognito trigger and a Lambda function. Is there someway that I could invalidate the tokens on this function?