Should a Laravel password change invalidate sessions, remember tokens, and API tokens?

Password-change revocation boundary

A Laravel application needs a precise policy for authenticated browser sessions, remember-me cookies, and issued API tokens after a user changes their password. The goal is to limit stale access while avoiding unnecessary sign-outs, with acceptance criteria that distinguish each credential type.

This draft assumes Laravel 11 or 12 using the standard session guard, without a third-party credential-expiration package. Exact behavior must be confirmed against the installed framework version and guard configuration. Password-reset token expiry is a separate mechanism, and request-time Gates or Policies do not by themselves define whether previously issued credentials remain valid.

Should a password change invalidate every active session and remember-me cookie, or should revocation be configurable with a grace period? When an account’s privileges are reduced, should existing sessions and Sanctum or Passport tokens lose access immediately, and which credential types belong in that revocation boundary?