title: Symfony3 Update Users data and Invalidate current sessions
body: <p>As I understand, When the user logs in successfully Symfony will keep a copy of the <code>User</code> document/entity either in the <code>session.handler.native_file</code> or a db provider, whichever is configured. On future requests this information is retrieved with the session id kept in the cookie.</p>
  
  <p>My problem is whenever a user updates its password or username (which is their e-mail), previously opened sessions on different computers or browsers don't expire or as set as invalid.</p>
  
  <p>The <code>EquatableInterface</code> is suppose to check against this but its not really working for me. As I added the following stub to the <code>User</code> class:</p>
  
  <pre><code>#User.php
  public function isEqualTo(UserInterface $user)
  {
      return false;
  }
  </code></pre>
  
  <p>Followed by a refresh on the browser nothing changed. My session was still valid and checking the <code>User</code> fetch with a <code>dump($this-&gt;getUser())</code> gave me the currently updated <code>User</code> and not the one was stored at the beginning of the session. </p>
  
  <p>I tried using:</p>
  
  <pre><code>#security.yml
  security:
      always_authenticate_before_granting: true
  </code></pre>
  
  <p>To if it would do anything, but it really didn't worked.</p>
  
  <p>Using the <em>Symfony Profiler</em>, I see that a <code>User</code> is been fetch from the db every time I do a request and I wonder if it is at this point the the <code>UserProviderInterface</code> just updated the user in the <code>security.token_storage</code> instead of first checking against changes to end session if necessary.</p>
  
  <p>To make sure this was happening I tested this controller on two different browsers:</p>
  
  <pre><code>#SomeController.php
  public function indexAction()
  {
      $encoder = $this-&gt;get('security.password_encoder');
      $user = $this-&gt;getUser();
  
      $flag = $encoder-&gt;isPasswordValid($user, 'MY_NEW_PASSWORD');
  
      dump($flag);
  
      return [];
  }
  </code></pre>
  
  <p>I logged in to my application on both browsers, then logout on browser A. I changed the <code>User</code> password to <code>'MY_NEW_PASSWORD'</code> and just refresh browser B. The dump was <code>true</code> for the new password.</p>
  
  <p>If this is the case I wonder:
  - Is there anyway to make a check against the db before granting authorization when the <code>User</code> is been fetch from the <code>security.token_storage</code>? (It would be a service that is runs on the fetch event I guess.)</p>
  
  <p>or maybe I'm over complicating stuff and there is a super simple solution that I just haven't figured out =|</p>