---
title: Session invalidation
description: There is currently no automatic mechanism to delete existing user sessions when the user changes their password. To implement automatic invalidation of existing sessions on password reset, consider one of the following approaches:
component: pingam
version: 7.3
page_id: pingam:security-guide:session-invalidation
canonical_url: https://docs.pingidentity.com/pingam/8.1/security/session-invalidation.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
---

# Session invalidation

There is currently no automatic mechanism to delete existing user sessions when the user changes their password. To implement automatic invalidation of existing sessions on password reset, consider one of the following approaches:

* Use the `logoutByUser` action, specifying the username in the request payload.

  This action can be used for server-side and client-side sessions and is described in [Invalidate all sessions for a user](../sessions-guide/managing-sessions-REST.html#invalidate-sessions-user).

* Use a query to locate all sessions for a user, then use the `logoutByHandle` action to invalidate those sessions.

  This action can be used for server-side sessions only and is described in [Invalidate specific sessions](../sessions-guide/managing-sessions-REST.html#invalidate-sessions-by-handle).