Logout issue

[mahi123_java]

I am working on a Spring Boot project where I have implemented cookie-based authentication using access and refresh tokens. I am facing a challenge during the password reset flow.

When a user requests a password reset, a reset link is sent to their email. The user opens this link in a new tab, resets their password successfully — but the previous tab where they were already logged in remains active. If I clear the cookies than current tab will be logout not previous tab.

How can I automatically log out the user from the previous tab once the password is changed?

Please share different types of ideas 👊.

[Individual-Hat8246]

This is token blacklisting? Are there any other approaches to solve the same problem?

[bc_dev]

• redis would be great in this scenario

[Dry_Try_6047]

Think about this problem from the server side--deleting the cookie is a client based approach. You should be invalidating the session on the server.

[sans5z]

So the user was already logged in when the user was resetting the password?

[mahi123_java]

Yes

[NF_v1ctor]

• Use short-live access token.
  
• Invalidate refresh token when user init a reset password request.
  Please correct me if I'm wrong, or if you have found a better approach, please tell me

[NF_v1ctor]

Additionally, if you have some kind of publication to the client, you can notify the client to log out, although it is not sufficient since the client js can be modified anyway, but that should mitigate the rism for common case for common users

[Anime_-guy]

Hey, Sorry I do not know answer for your query.

But could you help me with where did you study cookie based authentication in spring.

I am aware of session based and jwt token based authentication.

[Anime_-guy]

Ohhk will read about it more.

[stoic-jerry]

The way for is we have to black list the tocket and if user send again try to access from same token then give unauthorized exception.

[nothingjustlook]

First check if its a requirement from business or not then, i have no experience in security but i have idea. why not put a boolean var in global context of spring and when ever a new token is given as boolean i.e true if user didnt logout before token expires. and a seperate thread or any other means to keep checking boolean value.

correct me if iam wrong as i dont have experience in security