Revoke other active user sessions after changing the password

Ory Kratos Identities can revoke all other active sessions of a user when the user changes their password. The session that the user changed the password with stays active. To do this, add the revoke_active_sessions action to the hooks configuration of the settings flow.

Ory Network turns on this action when you create a project. To turn it on or off for an existing Ory Network project, read Revoke other sessions.

Configuration overview

Add the revoke_active_sessions action to the settings hook configuration in the config file.

config.yml

selfservice:
  flows:
    settings:
      after:
        password:
          hooks:
            - hook: revoke_active_sessions

To also revoke other sessions when a user recovers their account, read Invalidate other sessions.