---
title: "Verify password recovery revokes earlier sessions according to policy"
description: "Reset an account password while a prior session exists, then inspect and revisit that session to confirm the application enforces its revocation policy."
canonical_url: "https://vostride.com/agent-library/account-recovery/reset-revokes-sessions.md"
md_url: "https://vostride.com/agent-library/account-recovery/reset-revokes-sessions.md"
content_kind: "recipe"
topic: "account-recovery"
---

# Verify password recovery revokes earlier sessions according to policy

Reset an account password while a prior session exists, then inspect and revisit that session to confirm the application enforces its revocation policy.

## Risk

Changing a password may leave prior sessions active unless revocation is part of the recovery transaction. This recipe targets applications that explicitly promise recovery signs out earlier sessions, using separately controlled sessions rather than assuming a browser refresh is sufficient.

## Fixtures

- A disposable account with an earlier session captured for its configured web target.
- A test inbox and a separate signed-out recovery run for that account.
- A registered hook that identifies and checks only the seeded prior session plus the documented revocation deadline.

## Steps

1. In the earlier session, open a private account page and verify identity and fixture content; retain its test session identifier through the fixture mechanism.
2. In a separate recovery run, request and complete a password reset from the test inbox with a new secret.
3. Inspect the prior session through the application hook and verify it becomes invalid within the documented revocation boundary.
4. Revisit the private page using that earlier session in its own run and verify a fresh navigation requires authentication.
5. Sign in with the new password and verify access to the same account, distinguishing this new session from the revoked one.

## Expected results

- The seeded earlier session is revoked after the password reset within the stated product deadline.
- A fresh protected request using that session fails even if stale page content existed beforehand.
- A new session established with the replacement password remains usable.

## False-pass traps

- One agent-qa run selects one primary auth state; switching auth-state names inside a shared suite is not a supported shortcut.
- Signing out manually before checking revocation would make a broken reset-revocation rule appear to work.

## Cleanup

- Revoke all scenario sessions and restore the disposable account credential.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Account recovery QA recipes](/agent-library/account-recovery.md)
- [Software factory QA library](/agent-library.md)