# Why altering user object loses session?

**URL:** <https://forum.djangoproject.com/t/why-altering-user-object-loses-session/32579>\
**Category:** Mystery Errors\
**Created:** [June 30, 2024, 1:24pm UTC](https://forum.djangoproject.com/t/why-altering-user-object-loses-session/32579 "2024-06-30T13:24:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cseberino](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/cseberino/32/5026_2.png) [@cseberino](https://forum.djangoproject.com/u/cseberino)\
**Post date:** [June 30, 2024, 1:24pm UTC](https://forum.djangoproject.com/t/why-altering-user-object-loses-session/32579/1 "2024-06-30T13:24:58Z")

</div>

I’ve noticed when a logged in user uses a certain form, everything is fine unless they modify the user object.

If they modify the user object then the session info seems to be lost and they have to login again.

Why does modifying the user object seem to nuke the session?

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [June 30, 2024, 4:00pm UTC](https://forum.djangoproject.com/t/why-altering-user-object-loses-session/32579/2 "2024-06-30T16:00:16Z")

</div>

This is going to be tough to diagnose in the absence of seeing the code involved. We probably need to start with seeing this “certain form”, and the view that is processing it.

---

<div class="post-metadata">

**Author:** ![cseberino](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/cseberino/32/5026_2.png) [@cseberino](https://forum.djangoproject.com/u/cseberino)\
**Post date:** [June 30, 2024, 5:32pm UTC](https://forum.djangoproject.com/t/why-altering-user-object-loses-session/32579/3 "2024-06-30T17:32:11Z")

</div>

Ken

Thank you very much for your kind offer to help. I figured it out!

See

> <https://stackoverflow.com/questions/30821795/django-user-logged-out-after-password-change>

Apparently this is a “feature” added around ver 1.9! The logic, I suppose, is that  
if someone modifies their user object, then it may be good to quickly verify you  
can still log in. The link shows how to override it too if desired.

Cheers,

Chris

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [June 30, 2024, 5:51pm UTC](https://forum.djangoproject.com/t/why-altering-user-object-loses-session/32579/4 "2024-06-30T17:51:12Z")

</div>

I suggest, for your own benefit, to _never_ rely upon StackOverflow for accurate information about Django without referencing an authoritative source, nor to post links to it as references here. (SO is an “ok” starting point, but should never be considered authoritative.)

In this particular case, the information you’re looking for can be found at:

> **[Using the Django authentication system | Django documentation](https://docs.djangoproject.com/en/5.0/topics/auth/default/#session-invalidation-on-password-change)**
>
> The web framework for perfectionists with deadlines.

and

> <https://github.com/django/django/blob/a5215f9a3e9b8422678289c259e826f97e4dc63a/django/contrib/auth/ __init__.py#L256>

---

<div class="post-metadata">

**Author:** ![cseberino](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/cseberino/32/5026_2.png) [@cseberino](https://forum.djangoproject.com/u/cseberino)\
**Post date:** [June 30, 2024, 8:42pm UTC](https://forum.djangoproject.com/t/why-altering-user-object-loses-session/32579/5 "2024-06-30T20:42:45Z")

</div>

Thank you very much. It is much appreciated to get good help when one is stuck. Long live Django!