---
title: "End sessions when access changes · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/end-sessions-on-change
updated: 2026-10-20
licence: "All rights reserved"
---

# End sessions when access changes

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)
- Rule: End every other session when the password changes or a factor is removed. End every session when the account is disabled, deleted or locked after a "This wasn't me" report.
- How: Put the session cleanup in the same function and transaction as the change, so no code path forgets it. Keep the current session after a password change, because the person just proved who they are. A password reset already ends other sessions, as [make password resets safe](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-reset) says. Removal from one organisation ends access there only, as [remove access when someone leaves](https://agentwranglers.se/playbook/accounts/organisations-and-teams/member-removal) says.
- Check: Sign in from two browsers and change the password in the first. The second is signed out and the first stays in. Disable the test account as an admin, and the first is signed out too.

Example:

```js
export async function changePassword(db, userId, currentSessionId, newHash) {
  await db.tx(async tx => {
    await tx.none('UPDATE users SET password_hash = $1 WHERE id = $2', [newHash, userId]);
    await tx.none('DELETE FROM sessions WHERE user_id = $1 AND id <> $2', [userId, currentSessionId]);
  });
}
```

```python
def change_password(conn, user_id: str, current_session_id: str, new_hash: str) -> None:
    with conn.transaction():
        conn.execute("UPDATE users SET password_hash = %s WHERE id = %s", (new_hash, user_id))
        conn.execute("DELETE FROM sessions WHERE user_id = %s AND id <> %s", (user_id, current_session_id))
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/end-sessions-on-change`.

- Previous: [Let people sign out of one device or all of them](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/revoke-sessions)
- Next: [List connected apps and personal tokens](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/connected-apps)
- [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)