7

Last night I changed the password for my Stack Exchange OpenID. As a security precaution, I would expect that all of my sessions be invalidated and to be asked to log in again on all sites where I use the OpenID - after all, if someone gets my password and logs in as me before I can change it, changing it is next to pointless.

When I came into work this morning, I opened up Server Fault and to my surprise, I was in fact still logged in. Doing a bit of checking, I am also still logged into all other Stack Exchange sites I was pre password change.

I don't know the inner workings of how OpenID works, so this may not even be possible, however if there is any way all existing sessions can be invalidated upon a password change then please consider implementing this (maybe as an option on the password change page, if that's possible too).

|improve this question
5

You might be thinking of this the wrong way.

Pretend that your credential provider is, say, Yahoo. Would you expect that changing your password on Yahoo would magically invalidate all your Super User cookies?

We did change the "Log Out" behavior so that it kills almost everything by default -- HTML5 local storage (aka network credentials), site cookies, chat cookies, and even your openid.stackexchange.com cookies -- so all you need to do is click "Log Out".

|improve this answer
  • 1
    If I change a password on any website, I would expect all existing logins to be invalidated. Like I said, I don't know how OpenID works and if this is even possible but regardless of the OpenID provider I would expect this behaviour, if it was possible. – Ben Pilbrow Jun 13 '11 at 8:32
  • 1
    @ben you'll need to click "Log Out" first. – Jeff Atwood Jun 13 '11 at 8:39
  • sir - I faced the same problem earlier, but now my confusion is solved after reading this answer. thanks. +1 – PsyCoder Jun 13 '11 at 8:46
  • OK, will do. Just to be sure (sorry, not quite woken up yet) will logging out also kill sessions on other sites where I've logged in with my Stack Exchange OpenID (not Stack Exchange sites, that is)? – Ben Pilbrow Jun 13 '11 at 8:56
  • 1
    @ben no, only insofar as it clears HTML 5 local storage in the browser, which would trigger auto-login on a Stack Exchange site if you start from a logged-out state. Here's the fundamental thing to understand: one domain cannot touch the cookies of another domain. If you log out of Yahoo, does that magically log you out of Gmail? Same thing for Super User and Server Fault. Different domains, different cookies, neither can touch the other. – Jeff Atwood Jun 13 '11 at 9:02
  • 1
    @JeffAtwood but clearing local state wouldn't stop an attacker who has already authenticated from his own machine. So it's a good security practice to invalidate all of a user's sessions (except the current one) when a password is changed. OpenID gets in the way of this though - if the OP destroys a session, RPs may still keep the user authenticated for a while. Seems like there should be a way for an OP to notify RPs that an authentication has been invalidated and needs to be redone. – Daniel Lubarov Dec 9 '13 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .