{"action":"created","issue":{"url":"https://api.github.com/repos/symfony/symfony/issues/13712","labels_url":"https://api.github.com/repos/symfony/symfony/issues/13712/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony/issues/13712/comments","events_url":"https://api.github.com/repos/symfony/symfony/issues/13712/events","html_url":"https://github.com/symfony/symfony/issues/13712","id":57911900,"number":13712,"title":"remember me cookie is not invalidated/deleted on password change, credential expiration","user":{"login":"gondo","id":331103,"avatar_url":"https://avatars.githubusercontent.com/u/331103?v=3","gravatar_id":"","url":"https://api.github.com/users/gondo","html_url":"https://github.com/gondo","followers_url":"https://api.github.com/users/gondo/followers","following_url":"https://api.github.com/users/gondo/following{/other_user}","gists_url":"https://api.github.com/users/gondo/gists{/gist_id}","starred_url":"https://api.github.com/users/gondo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gondo/subscriptions","organizations_url":"https://api.github.com/users/gondo/orgs","repos_url":"https://api.github.com/users/gondo/repos","events_url":"https://api.github.com/users/gondo/events{/privacy}","received_events_url":"https://api.github.com/users/gondo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-17T11:17:43Z","updated_at":"2015-02-17T13:01:53Z","closed_at":null,"body":"**scenarion:**\r\n1. user log in with selected remember me. remember me cookie is created\r\n2. administrator on different computer change user password, or set credentials as expired\r\n3. user is still logged in until remember me cookie expire\r\n\r\n**expected:**\r\nonce administrator change user password or set credentials as expired, user should be logged out and remember me cookie should be invalidated.\r\n\r\nis there a way to make this happen on password change?\r\n"},"comment":{"url":"https://api.github.com/repos/symfony/symfony/issues/comments/74664118","html_url":"https://github.com/symfony/symfony/issues/13712#issuecomment-74664118","issue_url":"https://api.github.com/repos/symfony/symfony/issues/13712","id":74664118,"user":{"login":"jaytaph","id":241458,"avatar_url":"https://avatars.githubusercontent.com/u/241458?v=3","gravatar_id":"","url":"https://api.github.com/users/jaytaph","html_url":"https://github.com/jaytaph","followers_url":"https://api.github.com/users/jaytaph/followers","following_url":"https://api.github.com/users/jaytaph/following{/other_user}","gists_url":"https://api.github.com/users/jaytaph/gists{/gist_id}","starred_url":"https://api.github.com/users/jaytaph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaytaph/subscriptions","organizations_url":"https://api.github.com/users/jaytaph/orgs","repos_url":"https://api.github.com/users/jaytaph/repos","events_url":"https://api.github.com/users/jaytaph/events{/privacy}","received_events_url":"https://api.github.com/users/jaytaph/received_events","type":"User","site_admin":false},"created_at":"2015-02-17T13:01:53Z","updated_at":"2015-02-17T13:01:53Z","body":"These things should be checked when creating a `RememberMeToken` (by calling `setUser`, which in turn calls the private `hasUserChanged` method). If anything has changed in the user data, it should set the rememberme-token to unauthenticated (password, salt, locked out etc).\r\n\r\nI'm not 100% sure.. but it seems that in the in `rememberMeToken` constructor, the setUser is called correctly, but on the next line, it calls `parent::setAuthenticated(true);`, which set the rememberme cookie to be authenticated, even if the `setUser()` decided this wasn't the case.\r\n\r\nI'm not able to dive into this at the moment, but maybe somebody could verify if this is the issue?"}}