The OWASP Forgot Password Cheat Sheet suggests:


  Whenever a successful password reset occurs, the session should be invalidated and the user redirected to the login page


I'm failing to understand why this is so important. Is there a security basis for this recommendation and if so, what is it?

Lets say an attacker has your password. You log in and reset it. If the reset doesn't invalidate all existing sessions, the attacker still has access, as long as they don't let their session expire. 

The reset hasn't actually achieved anything in this scenario. 

Depending on what the site does, there could also be issues with having you signed in under a password which is now out of date. Lets say your password is used to unlock something, you are signed in with "password1", but the server now has your password saved as "password2", what happens? This is obviously hypothetical, but hopefully illustrates the point. 

Redirecting to the login screen I guess is just a recommendation. I'm not sure why it matters where you send the user, but from a usability point of view it makes more sense to send the user to a login page rather than the home page.
