Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Why should changing a user's password trigger invalidation of every OTHER active session for that user, not just require the current session to re-authenticate?
💻 Code Challenge | +75 XP
Implement session storage in Redis with both idle timeout (30 minutes) and absolute timeout (12 hours) enforcement, and a session invalidation function that revokes all sessions except the current one, triggered on password change.
A user reported that after changing their password due to a suspected compromise, an attacker remained logged in on a different device using a session established before the password change. Reorder the steps to fix this.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Changing a user's password without invalidating their other active sessions
// Wrong: attacker's existing session remains valid after the change
await updatePasswordHash(userId, newPassword);
// Correct: every OTHER session is invalidated
await updatePasswordHash(userId, newPassword);
await revokeAllSessionsExcept(userId, currentSessionId);The Solution //
If an attacker gained access via a stolen password and the legitimate user changes their password to resecure their account, any session the attacker had already established remains valid unless explicitly invalidated — the attacker retains access despite the password change, defeating its security purpose.
The Error //
Implementing only an idle timeout with no absolute maximum session timeout
// Insufficient alone: no upper bound on total session length
if (idleTime > IDLE_TIMEOUT) invalidate(session);
// Correct: both protections, addressing different risk scenarios
if (idleTime > IDLE_TIMEOUT) invalidate(session);
if (totalSessionAge > ABSOLUTE_TIMEOUT) invalidate(session);The Solution //
An idle timeout alone allows a session to be extended indefinitely as long as some activity occurs periodically, with no upper bound on the total session length — an absolute timeout provides an important additional safeguard by bounding the maximum session duration regardless of ongoing activity.