iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Changing a password or rotating a secret does not necessarily end sessions that were already issued. A browser cookie, identity-provider token, cloud temporary credential, or local client cache may continue to authorize requests without checking the new credential. To stop access, first identify which artifact is still being accepted, then revoke it at the layer that issued or validates it.
Why credential rotation may not end a session
A password or secret is usually checked when a client authenticates. Afterward, the service may accept a session artifact—such as a cookie or token—on later requests. If the service does not re-check the changed credential each time, the existing session can remain usable until it expires or is explicitly revoked.
“Session cache” can mean several different things: a browser cookie, a server-side application session, an identity-provider refresh or access token, a device sign-in token, temporary cloud credentials, or a local CLI or SDK cache. They are not interchangeable, and clearing one does not automatically invalidate the others.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIdentify what is still granting access
Start by comparing two situations: does access continue only in an already signed-in browser or app, or can a completely new sign-in still authenticate with the old credential? If only the existing session works, a previously issued artifact may still be accepted. If a new sign-in with the old credential succeeds, investigate whether the credential change reached the intended account or system, or whether another authentication method is being used.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Artifact | Who issues or controls it | What to investigate |
|---|---|---|
| Application cookie or server session | The application | Whether the app invalidated its server-side session record or session version, as well as the browser cookie. |
| Identity-provider refresh or access token | The identity provider, with possible separate application sessions | Provider revocation controls, token expiry, and whether the app accepts its own cookie independently. |
| Device sign-in token | The identity platform and device sign-in flow | Device state, sign-in method, and whether later cloud authorization has been revoked. |
| Temporary cloud credential | The cloud service | Credential issue time, expiry, and the service’s supported cutoff or revocation mechanism. |
| CLI or SDK cache | The local client | Whether the client is reusing cached credentials rather than requesting new ones. |
Revoke the layer that is accepting the old session
Application cookie or server-side session
For an application-issued session, use the application’s session-management or account-security controls to invalidate the server-side session record or advance its session version, according to the app’s design. Clear the corresponding client cookie when appropriate. OWASP’s Session Management Cheat Sheet emphasizes that expiration requires active invalidation on both client and server; deleting a cookie alone does not make a server-accepted session identifier invalid.
Identity-provider token and application session
Use the identity provider’s current revocation controls, but check whether the application also maintains its own session. Microsoft warns that a browser app may issue its own token after authentication and that Microsoft Entra cannot directly revoke that application-issued token; the application must apply its own authorization policy. Microsoft also notes that revocation can take time to become effective. See the Microsoft Entra emergency access guidance.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Microsoft Graph’s revokeSignInSessions documentation says the operation invalidates a user’s refresh tokens and browser session cookies. The cited documentation is for the beta API, which Microsoft says may change and is not supported for production use. Verify the currently supported API version and its behavior before using it operationally: revokeSignInSessions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Device sign-in state
A device sign-in token can behave differently from a browser cookie or cloud access token. Microsoft’s Primary Refresh Token guidance describes behavior that depends on sign-in method and device state: a password change can invalidate a PRT obtained with that password, but cached device sign-in and subsequent cloud authorization are separate considerations. Do not assume one password change immediately signs every device out. Consult Microsoft’s Primary Refresh Token guidance for the applicable device and sign-in flow.
AWS assumed-role credentials and CLI cache
AWS documents a policy-based way to deny IAM role credentials issued before a chosen timestamp. Its console revocation approach sets the cutoff approximately 30 seconds into the future from the action time to allow for policy propagation. This is AWS IAM behavior, not a general cloud guarantee. Follow the AWS procedure for the affected role and account: Revoke IAM role temporary security credentials.
AWS also documents that the CLI can cache credentials until they expire. To make the CLI request credentials again after revoking role credentials, remove the cache directory: ~/.aws/cli/cache on applicable systems, or the corresponding AWS CLI cache location on Windows. This clears a local CLI cache; it does not revoke a browser session or invalidate every application’s server-side session. See AWS CLI configuration for SSO.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Interpret token lifetimes in context
Expiry is not the same as immediate revocation, and vendor examples are not universal protocol lifetimes. Microsoft’s 2024 Microsoft 365 session-timeout guidance describes access tokens as valid for one hour and refresh tokens as valid for 90 days, subject to revocation and the conditions on that page. It also describes service-specific browser behavior. These figures apply to the stated Microsoft 365 context, not every OAuth token or web session: Microsoft 365 session timeouts.
Microsoft Conditional Access guidance describes a default rolling sign-in frequency of 90 days in its stated context. Policy and application support affect the result, so that default is not a universal recommendation or a promise that all sessions last that long: Configure authentication session management with Conditional Access.
Verify that access is actually revoked
- Identify the exact artifact still being used: application cookie, server-side session, provider token, device token, temporary cloud credential, or local client cache.
- Revoke or invalidate it at the system that accepts it. If the app has its own session, address that session in addition to provider-side tokens.
- Refresh or clear only the relevant client cache when needed to force a fresh credential request. Do not treat local cleanup as server-side revocation.
- Make a fresh request using the old session artifact and confirm that it is rejected; then check the relevant application or provider logs for the result.
The precise controls depend on the identity provider, application framework, session-store design, token type, and whether the client is a browser, command-line tool, or service. Confirm the applicable platform documentation and version before applying an implementation-specific procedure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
