title: Asp .Net Identity 2 - Logging out other sessions (using security stamp) after password update also logs out current session
body: <p>I need to immediately invalidate and log out any other logged in sessions when a user changes their password, but allow the active session (who has just updated their password) to remain logged in. </p>
  
  <p>To do this, I'm using the <code>UpdateSecurityStampAsync(currentUser.Id);</code> method on the UserManager. All other sessions are successfully logged out, but the active session is also logged out despite the call to <code>SignInAsync</code> after updating the security stamp.</p>
  
  <p>The Identity configuration I'm using is as follows: </p>
  
  <pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions
  {
      AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
      LoginPath = new PathString("/Login"),
      Provider = new CookieAuthenticationProvider
      { 
          OnValidateIdentity = SecurityStampValidator.OnValidateIdentity&lt;ApplicationUserManager, ApplicationUser&gt;(
              validateInterval: TimeSpan.FromMinutes(0),
              regenerateIdentity: (manager, user) =&gt; user.GenerateUserIdentityAsync(manager))
      },
      CookieHttpOnly = true,
      CookieSecure = CookieSecureOption.SameAsRequest,
      SlidingExpiration = false,
      ExpireTimeSpan = TimeSpan.FromMinutes(10)
  });
  </code></pre>
  
  <p>The controller code snippet that is updating the password, updating the security stamp, and supposedly logging the current user back in is:</p>
  
  <pre><code>var updateResult = await _userManager.ChangePasswordAsync(currentUser.Id, form.CurrentPassword, form.NewPassword);
  if (!updateResult.Succeeded)
  {
      //handle update failure
  }
  
  _signInManager.AuthenticationManager.SignOut();     
  
  //updating the security stamp invalidates all other sessions
  await _userManager.UpdateSecurityStampAsync(currentUser.Id);
  
  await _signInManager.SignInAsync(currentUser, false, false);
  </code></pre>
  
  <p>Running the code, the password is successfully updated and all sessions are logged out due to the security stamp being updated. But based on other examples I've seen (like this <a href="https://stackoverflow.com/questions/35221022/logout-user-from-all-browser-when-password-is-changed">answer from Chris</a>), the code above should refresh the auth cookie and keep the active user logged in. </p>
  
  <p>I've tried different variations of the above code:</p>
  
  <ul>
  <li>Moving the sign out to after the security stamp update</li>
  <li>Removing the sign out altogether</li>
  <li>Using the  synchronous <code>SignIn</code> extension method instead of the async one</li>
  </ul>
  
  <p>all variations produce the same result: The user is forced to log back in after changing their password.</p>
  
  <p>Is there a configuration error or something else that I've overlooked?</p>
  
  <p>EDIT: 
  I've unintentionally fixed the problem by adding in the <code>DefaultAuthenticationTypes</code> into the <code>SignOut</code> call. </p>
  
  <p>The relevant code now reads as:</p>
  
  <pre><code>//updating the security stamp invalidates all other sessions
  await _userManager.UpdateSecurityStampAsync(currentUser.Id);
  _signInManager.AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
  await _signInManager.SignInAsync(currentUser, false, false);
  </code></pre>
  
  <p>However, if anyone could explain why the Authentication type is important in this case?  </p>