2

Is it a good practice to implement automatic log-out in an android App after changing the password through the app?

2 Answers 2

2

TL;DR : Yes.

There are only two cases here:

  • (Unlikely) Your application only works locally, with no use of the login and password on any remote server. If you don't logout for years the app will keep working as if nothing happened, so what's the point of changing the password?

  • Your application sends credentials to a remote server to establish a login. In this case you should not only logout the user from the Android application, but you should log them out of every instance of the application, on all devices on which the app is run, and also from all web instances if that's the case. If someone guessed the user password and you don't invalidate whatever kind of token you have, they'll be able to keep using those credentials, even if the user changes them.

So yes, log them out everywhere.

1
  • 1
    The second point is especially important. Having a forced logout of all sessions on a password change is extremely important for locking out a potentially compromised account. Commented Nov 26, 2018 at 19:47
0

Most likely not. If a session is important enough to warrant termination on a password change, the sessions probably shouldn't last more than 15-30 minutes to begin with (or require a mobile PIN to unlock). Otherwise, the password change screen should prompt the user to review existing sessions and allow the user to choose to terminate sessions they don't recognize. It would be user hostile to force all sessions to be terminate all sessions automatically without choice. Of all the security measures you could choose to implement, this is the one policy that would cause the most inconvenience with only marginal security benefits.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .