Hacker News Reader

I agree - but it should be an option, rather than permanent.

So that's how they address the state issue. They just ignore the problem!

I always wondered how they addressed the state problem of cookie bearer tokens.

The easy and widespread solution to this issue is simply to ask the user if they would like to log out their other devices when they change their password.

LTT found out the hard way, their attacker had a session token for an employee and changing everyone’s passwords didn’t lock the attacker out.