Edtech Password Reset Controls: Token Expiry, Session Revocation and Audit Logs

The piece argues that an education platform should only leave a managed identity provider if its password reset flow can invalidate a stolen session, enforce token expiry, and keep an audit trail that never stores the reset email link. It stresses that a successful password change alone does not prove an account is secure, since existing sessions may remain active. The four proposed controls are a uniform response to reset requests, bounded token validity, session revocation after confirmed reset, and a minimal audit record. Acceptance testing should cover expiry boundaries, token reuse, refresh-token rotation, and whether old and new authentication paths overlap during migration. Audit events are limited to a small application-owned vocabulary, and tokens, passwords and authorization headers are excluded from logs.