Plugin creating multiple sessions

@robert681 Yes, the plugin creates the first session when you enter the username/password which is then invalidated for the second-factor entry. We need to do that since WordPress sends the authentication cookies before it triggers wp_login.

Thanks for the detailed answer @kasparsd

Since the first session is invalidated for the second-factor entry, how come it is still shown as a valid session in the database?

I’m just trying to understand how to better monitor the logged in sessions with our plugin.

I’m not sure. It can probably be voided, tbh, I think the code may predate the multiple session management in core though.

Thanks for your answer @georgestephanis

We can configure the plugin to delete one of the sessions, however it would be too risky. The chances of deleting a valid session especially on a busy website are too high.

Is there an option for us (we can even contribute to the code if you want) to delete the first invalidated session once the second one (with 2FA) is successfully authenticated?

If we do so the DB will be cleaner and the records of logged in sessions will be correct.

Thoughts?