Existing Laravel Jetstream web sessions remain active after two-factor authentication is enabled

Goal

Determine whether an already authenticated Laravel Jetstream web session should require immediate two-factor re-verification after a user enables two-factor authentication, or whether the session stays valid until normal expiration or explicit logout.

Constraints and uncertainty

Jetstream delegates the two_factor_enabled column and verification flow to Laravel Fortify, so the installed Fortify version can change behavior. Jetstream provides no built-in option to force all active sessions to re-verify two-factor authentication immediately after enablement. The Livewire and Inertia settings UIs may render differently while sharing the same backend actions, and Sanctum API tokens issued before enablement may not follow web session rules. Confirm the Jetstream and Fortify versions declared in composer.json before relying on any version-specific behavior.

Questions

• Does an existing authenticated web session continue to work without a two-factor challenge after the user enables two-factor authentication?
• Is immediate session invalidation or re-challenge controlled by Fortify, Jetstream, or application middleware?
• Do installed Jetstream and Fortify versions affect whether existing sessions are challenged after two-factor activation?