Skip to content

Invalidate AccessTokens on password change - #3018

Merged
bajtos merged 1 commit into
masterfrom
fix/session-expiry2
Dec 12, 2016
Merged

Invalidate AccessTokens on password change#3018
bajtos merged 1 commit into
masterfrom
fix/session-expiry2

Conversation

@bajtos

Copy link
Copy Markdown
Member

Invalidate all existing sessions (delete all access tokens) after user's password was changed.

This patch supersedes #2665

Connect to strongloop-internal/scrum-loopback#925

@loay@raymondfeng PTAL

@bajtos

Copy link
Copy Markdown
MemberAuthor

Many of the changes in the test file are whitespace-only, see https://github.com/strongloop/loopback/pull/3018/files?w=1

@bajtosbajtos mentioned this pull request Dec 9, 2016
loay
loay approved these changes Dec 9, 2016

@loayloay left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tested. All functions work for both email and password change.
LGTM

@loay

loay commented Dec 9, 2016

Copy link
Copy Markdown
Contributor

@slnode test please

1 similar comment
@loay

loay commented Dec 9, 2016

Copy link
Copy Markdown
Contributor

@slnode test please

Comment threadcommon/models/user.js Outdated
};

User._invalidateAccessTokensOfUsers = function(userIds, cb) {
if (!userIds.length) return cb();

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we check with !Array.isArray(userIds) || !userIds.length?
I think we need to use process.nextTick to cb() too.

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed - see 062c529

Invalidate all existing sessions (delete all access tokens)
after user's password was changed.
@bajtos
bajtos merged commit f27cd2c into masterDec 12, 2016
@bajtos
bajtos deleted the fix/session-expiry2 branch December 12, 2016 12:50
@bajtosbajtos removed the #review label Dec 12, 2016
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants

@bajtos@loay@timlind@raymondfeng@superkhau