{"record":{"id":"42bd7021e2c95c5f","repo":"Dolibarr/dolibarr","slug":"errorsessioninvalidatedafterpasswordchange","errorCode":null,"errorMessage":"ErrorSessionInvalidatedAfterPasswordChange","messagePattern":"ErrorSessionInvalidatedAfterPasswordChange","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"htdocs/main.inc.php","lineNumber":993,"sourceCode":"\t\t\tsession_destroy();\n\t\t\tsession_set_cookie_params(0, '/', null, !empty($dolibarr_main_force_https), true); // Add tag secure and httponly on session cookie\n\t\t\tsession_name($sessionname);\n\t\t\tdol_session_start();\n\n\t\t\tif ($resultFetchUser == 0) {\n\t\t\t\t$langs->loadLangs(array('main', 'errors'));\n\n\t\t\t\t$_SESSION[\"dol_loginmesg\"] = $langs->transnoentitiesnoconv(\"ErrorCantLoadUserFromDolibarrDatabase\", $login);\n\n\t\t\t\t$user->context['audit'] = 'ErrorCantLoadUserFromDolibarrDatabase - login='.$login;\n\t\t\t} elseif ($resultFetchUser < 0) {\n\t\t\t\t$_SESSION[\"dol_loginmesg\"] = $user->error;\n\n\t\t\t\t$user->context['audit'] = $user->error;\n\t\t\t} else {\n\t\t\t\t$langs->loadLangs(array('main', 'errors'));\n\n\t\t\t\t$_SESSION[\"dol_loginmesg\"] = $langs->transnoentitiesnoconv(\"ErrorSessionInvalidatedAfterPasswordChange\");\n\n\t\t\t\t$user->context['audit'] = 'ErrorUserSessionWasInvalidated - login='.$login;\n\t\t\t}\n\n\t\t\t// Call trigger\n\t\t\t$result = $user->call_trigger('USER_LOGIN_FAILED', $user);\n\t\t\tif ($result < 0) {\n\t\t\t\t$error++;\n\t\t\t}\n\t\t\t// End call triggers\n\n\t\t\t// Hooks on failed login\n\t\t\t$action = '';\n\t\t\t$hookmanager->initHooks(array('login'));\n\t\t\t$parameters = array('dol_authmode' => (string) $dol_authmode, 'dol_loginmesg' => $_SESSION[\"dol_loginmesg\"]);\n\t\t\t$reshook = $hookmanager->executeHooks('afterLoginFailed', $parameters, $user, $action); // Note that $action and $object may have been modified by some hooks\n\t\t\tif ($reshook < 0) {\n\t\t\t\t$error++;","sourceCodeStart":975,"sourceCodeEnd":1011,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/main.inc.php#L975-L1011","documentation":"After a successful password change Dolibarr invalidates all existing sessions for that user. When a request comes in with an old session cookie, main.inc.php detects the invalidated session, stores the translated message 'ErrorSessionInvalidatedAfterPasswordChange' into $_SESSION['dol_loginmesg'] and records a USER_LOGIN_FAILED audit trigger. It is an informational security notice, not a bug: the user simply must log in again.","triggerScenarios":"A user changes their password (or an admin resets it) while another browser/tab still holds a session cookie; on the next page load the old session is rejected and this message is queued for display on the login page.","commonSituations":"Users with multiple devices or open tabs after a password reset; shared accounts where one person rotates the password; automated scripts/API clients using a session cookie that survived a password change; session persistence tests in CI.","solutions":["Log in again with the new password; the message is expected behavior.","Close stale tabs/sessions or clear the Dolibarr cookie (DOLSESSID) on affected devices.","If scripts break, update them to re-authenticate after any password change, or use dedicated API tokens instead of session cookies.","If the message appears immediately after login with the CORRECT new password, check the session invalidation logic/trigger USER_SESSION_LAUNCH on the user record and clear stale rows.","Suppress/verify the message rendering by checking $langs->loadLangs(['main','errors']) is called so the key translates instead of showing the raw key."],"exampleFix":"// before (script keeps using old cookie)\ncurl -b old_session_cookie.php https://doli.example.com/htdocs/index.php\n// after (re-login after password change)\ncurl -c jar.php -d \"login=user&password=newpass\" https://doli.example.com/htdocs/index.php?mainmenu=home","handlingStrategy":"fallback","validationCode":"// in an API client: detect invalidated session and re-authenticate\nif (preg_match('/ErrorSessionInvalidatedAfterPasswordChange/', $body) || $response->getStatus() === 200 && str_contains($body, 'dol_loginmesg')) {\n    $this->login($user, $newPassword);\n}","typeGuard":"function isSessionInvalidatedNotice(string $body): bool {\n    return str_contains($body, 'ErrorSessionInvalidatedAfterPasswordChange');\n}","tryCatchPattern":"try {\n    $page = $client->get('/htdocs/index.php');\n} catch (AuthException $e) {\n    $client->relogin(); // session was invalidated after a password change\n}","preventionTips":["Re-authenticate all clients immediately after any password change.","Prefer API tokens over session cookies for integrations.","Close unused tabs/devices before rotating passwords.","Expect this message on the login page and surface it to users as 'please log in again', not as a system failure."],"tags":["session","authentication","password-change"],"backgroundTag":"authentication-required","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}