From Wikipedia
Stevens eventually identifies both the bomber, a young man, Derek Frost (Michael Arden), and the rented white van that he will use to carry the bomb into the center of Chicago. On his return, Stevens' information is successfully used by the military to capture Frost before he can trigger the bomb. Stevens is praised as a hero, but in private, Rutledge tells Goodwin to renege on the deal, and instead to wipe Stevens' memory so he can be used the next time there is such an incident. Stevens learns that the promise to him has been violated and convinces Goodwin to let him return to Source Code once more, after which she will disable his life support against Rutledge's orders.
Once back aboard the train, Stevens disarms the bomb, subdues Frost and handcuffs him to a handrail inside the train. Stevens calls the authorities to identify Frost and inform them of the location of the dirty bomb. He then calls his (alternate-timeline) estranged father under the guise of a fellow soldier, mending the emotional distance between them. Asking Christina what she would do if she knew that she only had seconds left to live, Stevens embraces her just as his last few seconds are presumably running out. As promised, at this exact moment, Goodwin disables his life-support and the scene reveals his physical body as being severely mutilated and comatose. Time seems to stop just then, but Stevens is surprised to find himself finishing the kiss, still aboard the train with Christina. He realizes that he will remain in the alternative timeline of the undamaged train. They arrive safely in Chicago, and he and Christina take a little stroll together and warmly discuss their future together.
Later that morning, the alternative-timeline Captain Goodwin arrives for work at Nellis Air Force Base and receives a text message that Stevens had sent earlier, just as news is breaking of the failed attempt on the train just outside Chicago. The email explains that the Source Code effectively allows the user to change history within alternative timelines. Stevens' email ends with him proposing to Goodwin that when his alternative self in this timeline is used in a future Source Code mission, Goodwin should support him with a reassurance that "everything is gonna be okay."