Should a Laravel password change invalidate sessions, remember tokens, and API tokens?
Password-change revocation boundary A Laravel application needs a precise policy for authenticated browser sessions, remember-me cookies, and issued API tokens after a user changes their password. The goal is to limit stale access while avoiding unnecessary sign-outs, with acceptance criteria that distinguish each credential type. This draft assumes Laravel
laravel