Repository navigation
Revoking reset password links? #39927
Unanswered
RyanColantuono
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I'm looking into a security ask. So far I don't think its easily possible, but I wanted to ask on here incase I am missing something.
The ask is if someone logs in or does another similar action, existing reset password emails/links are then expired. Lets say someone use forgot password, but then remembers their email and logs in. The ask would then be that any reset password links for that user would be expired so that they could not be used by an attacker.
I don't see anything in the api that would allow for this. I could create something custom that we could trigger based on a login event, but poking around at the source code I'm having trouble tracking down a way to get what the action tokens are for a user and expire them, if thats possible at all.
Is there a way to do this in code? I can see when the email is sent ResetCredentialEmail.java and its builds the ResetCredentialsActionToken, but a little lost on if I can actually do anything to force that to no longer be valid.
All reactions