{"action":"closed","issue":{"url":"https://api.github.com/repos/plataformatec/devise/issues/3950","repository_url":"https://api.github.com/repos/plataformatec/devise","labels_url":"https://api.github.com/repos/plataformatec/devise/issues/3950/labels{/name}","comments_url":"https://api.github.com/repos/plataformatec/devise/issues/3950/comments","events_url":"https://api.github.com/repos/plataformatec/devise/issues/3950/events","html_url":"https://github.com/plataformatec/devise/issues/3950","id":132926893,"number":3950,"title":"Remember_token always regenerated when user logs in: existing one never kept anymore","user":{"login":"michieldewit","id":5517741,"avatar_url":"https://avatars.githubusercontent.com/u/5517741?v=3","gravatar_id":"","url":"https://api.github.com/users/michieldewit","html_url":"https://github.com/michieldewit","followers_url":"https://api.github.com/users/michieldewit/followers","following_url":"https://api.github.com/users/michieldewit/following{/other_user}","gists_url":"https://api.github.com/users/michieldewit/gists{/gist_id}","starred_url":"https://api.github.com/users/michieldewit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michieldewit/subscriptions","organizations_url":"https://api.github.com/users/michieldewit/orgs","repos_url":"https://api.github.com/users/michieldewit/repos","events_url":"https://api.github.com/users/michieldewit/events{/privacy}","received_events_url":"https://api.github.com/users/michieldewit/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/plataformatec/devise/labels/Bug","name":"Bug","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":19,"created_at":"2016-02-11T09:37:41Z","updated_at":"2016-05-15T14:48:12Z","closed_at":"2016-05-15T14:48:12Z","body":"In commit https://github.com/plataformatec/devise/commit/c92996646aba2d25b2c3e235fe0c4f1a84b70d24 a change was made that causes `remember_token`s to be regenerated without checking whether the old one has expired. This causes a problem when users log in on multiple browsers or devices. Every time they log in, their session on other browsers/devices is invalidated, because a new token is generated.\r\n\r\nMy project is forced to stick with Devise 3.5.3 because of this breaking change. The fact that the commit I mentioned still contains a TODO is probably indicative of the fact this is a problem to be resolved."}}