New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

Revoke other sessions

The revoke_active_sessions action signs a user out of all their other sessions. The session that triggered the action stays active. Ory Kratos Identities can run this action after a user:

  • Changes their password.
  • Recovers their account.
  • Signs in.

After a password change​

When a user changes their password, the revoke_active_sessions action revokes all other sessions of that user. Anyone who signed in with the old password loses access. The user stays signed in on the device they used to change the password.

Ory Network turns on this action when you create a project.

  1. Go to Authentication → Sessions in the Ory Console.
  2. Toggle Revoke other sessions after password change.
  3. Click Save.
note

Actions defined for the password method replace the actions defined for all methods of the settings flow. While the revoke_active_sessions action is set for the password method, webhooks that you defined for all methods of the settings flow don't run when a user changes their password. Add these webhooks to the password method as well. Read more about trigger precedence.

After account recovery​

When a user recovers their account, the revoke_active_sessions action revokes all other sessions of that user. Anyone who had access to the account must sign in again.

Ory Network turns on this action when you create a project.

  1. Go to Authentication → Account recovery in the Ory Console.
  2. Toggle Revoke other sessions after recovery.
  3. Click Save.

After sign-in​

When a user signs in, the revoke_active_sessions action signs the user out on all other devices. Each user then has exactly one active session and device at a time.

Run this command to turn on the action:

ory patch identity-config --project <project-id> --workspace <workspace-id> \
  --add '/selfservice/flows/login/after/hooks/-={"hook":"revoke_active_sessions"}'

To run the action for specific sign-in methods, read Revoke previously issued sessions at login.