Security Flaw - Sessions remain active after password reset.

[Donellereed]

It looks like Fusion 360 has a bit of a security flaw. There doesn't seem to be a way to terminate a session from a device you no longer have access to. 

For instance, if you've signed in on a public computer, but you forget to sign out, there doesn't appear to be an option to terminate that session. Even if you change your password, your account remains signed in on all devices. 

I even tried activating two-factor authorization, and that still did not terminate existing sessions. If this is true, then this is a serious security flaw. 

Someone, please correct me if I'm wrong - is there some option to terminate sessions on other devices? How long does a session last once you've signed in? 

Thanks!

[jodom4 · Accepted solution]

Thanks for bringing this to our attention, Donellereed. This is a known issue that we're actively working on. I don't have a date for deployment, but I know a solution will be included in a forthcoming release.