Dolibarr/dolibarr · info

ErrorSessionInvalidatedAfterPasswordChange

Error message

ErrorSessionInvalidatedAfterPasswordChange

What it means

After a successful password change Dolibarr invalidates all existing sessions for that user. When a request comes in with an old session cookie, main.inc.php detects the invalidated session, stores the translated message 'ErrorSessionInvalidatedAfterPasswordChange' into $_SESSION['dol_loginmesg'] and records a USER_LOGIN_FAILED audit trigger. It is an informational security notice, not a bug: the user simply must log in again.

Solutions

1. Log in again with the new password; the message is expected behavior.
2. Close stale tabs/sessions or clear the Dolibarr cookie (DOLSESSID) on affected devices.
3. If scripts break, update them to re-authenticate after any password change, or use dedicated API tokens instead of session cookies.
4. If the message appears immediately after login with the CORRECT new password, check the session invalidation logic/trigger USER_SESSION_LAUNCH on the user record and clear stale rows.
5. Suppress/verify the message rendering by checking $langs->loadLangs(['main','errors']) is called so the key translates instead of showing the raw key.

Example fix

// before (script keeps using old cookie)
curl -b old_session_cookie.php https://doli.example.com/htdocs/index.php
// after (re-login after password change)
curl -c jar.php -d "login=user&password=newpass" https://doli.example.com/htdocs/index.php?mainmenu=home

// in an API client: detect invalidated session and re-authenticate
if (preg_match('/ErrorSessionInvalidatedAfterPasswordChange/', $body) || $response->getStatus() === 200 && str_contains($body, 'dol_loginmesg')) {
    $this->login($user, $newPassword);
}

function isSessionInvalidatedNotice(string $body): bool {
    return str_contains($body, 'ErrorSessionInvalidatedAfterPasswordChange');
}

try {
    $page = $client->get('/htdocs/index.php');
} catch (AuthException $e) {
    $client->relogin(); // session was invalidated after a password change
}

When it happens

Trigger: A user changes their password (or an admin resets it) while another browser/tab still holds a session cookie; on the next page load the old session is rejected and this message is queued for display on the login page.

Common situations: Users with multiple devices or open tabs after a password reset; shared accounts where one person rotates the password; automated scripts/API clients using a session cookie that survived a password change; session persistence tests in CI.

Related errors

• ERROR_NOT_LOGGED
• You are logged with user
• ErrorConfigParameterNotDefined

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/42bd7021e2c95c5f. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/main.inc.php:993

			session_destroy();
			session_set_cookie_params(0, '/', null, !empty($dolibarr_main_force_https), true); // Add tag secure and httponly on session cookie
			session_name($sessionname);
			dol_session_start();

			if ($resultFetchUser == 0) {
				$langs->loadLangs(array('main', 'errors'));

				$_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("ErrorCantLoadUserFromDolibarrDatabase", $login);

				$user->context['audit'] = 'ErrorCantLoadUserFromDolibarrDatabase - login='.$login;
			} elseif ($resultFetchUser < 0) {
				$_SESSION["dol_loginmesg"] = $user->error;

				$user->context['audit'] = $user->error;
			} else {
				$langs->loadLangs(array('main', 'errors'));

				$_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("ErrorSessionInvalidatedAfterPasswordChange");

				$user->context['audit'] = 'ErrorUserSessionWasInvalidated - login='.$login;
			}

			// Call trigger
			$result = $user->call_trigger('USER_LOGIN_FAILED', $user);
			if ($result < 0) {
				$error++;
			}
			// End call triggers

			// Hooks on failed login
			$action = '';
			$hookmanager->initHooks(array('login'));
			$parameters = array('dol_authmode' => (string) $dol_authmode, 'dol_loginmesg' => $_SESSION["dol_loginmesg"]);
			$reshook = $hookmanager->executeHooks('afterLoginFailed', $parameters, $user, $action); // Note that $action and $object may have been modified by some hooks
			if ($reshook < 0) {
				$error++;

View on GitHub (pinned to 598aa4bdad)