Edtech Password Recovery: Auditing Global Logout with Session Inventory

Edtech companies should treat global logout as a reconciliation process rather than a simple button click. When a user requests a password reset, it's crucial to snapshot all active sessions, revoke them from the session inventory, and then confirm that each identifier has been rejected. Simply receiving a success message is not enough - the system must prove that the revocation was successful.

In an edtech context, a learner might have multiple devices open simultaneously - a browser, a phone, a shared tablet, and perhaps even a proctoring window. Resetting the password without closing all these sessions leaves the old credentials vulnerable. The key decision is balancing security with user experience - a high-risk reset requires a full global logout, while an ordinary password change can be less disruptive if policies permit it.

The incident highlights that logout is a state transition, not just a button press. The logout handler must account for all session stores - cookies, refresh tokens, mobile sessions, and web sessions from different devices. It returns 200 to indicate success, but deletes only one record. However, the UI may still show the user as "signed out," even if another device retains access. Following the reset, the next request from a second device should still succeed.

To ensure proper logout, an auditor should review the timeline, noting when the reset request arrived, the cutoff for the inventory, which database replica observed the revoke, which cache served the older decision, and whether a phone still presented an active refresh token that was never recorded in the browser table. Each step in this process needs a timestamp and an assigned owner.

The incident report should distinguish between a token that was absent at the cutoff time and a token that was present but rejected. This distinction is crucial for both incident response and for what auditors can reproduce when reviewing the system's behavior.

Auditors should keep the probe harness separate from the normal learner path. This way, the audit check doesn't interfere with course progress, consume one-time recovery codes, or trigger unnecessary notifications. A bounded queue allows operators to pause, resume, and inspect the work without assuming that the completion happened immediately.

When processing a forgot-password request, the system should first record a risk decision before sending the reset message. If the request is verified and legitimate, it may require a global logout. However, an unverified or suspicious request should not grant a new session. The reset token should be kept separate from session identifiers, hashed at rest, and given an explicit expiry.

Raw tokens should never be included in audit events. The key invariant is that for every user and revocation event, every session that was active at the inventory cutoff must either be revoked or explicitly accounted for - anything left as "unknown" is an incident state, not a pass.