Invalidate session after password reset via edge
Open
bug
- Dominant language
- Rust
- Stars
- 2.8k
- Forks
- 115
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 50
Description
After doing password reset via proxy, all users sessions are intact. We should invalidate them.
Contributor guide
Research direction
Start by tracing the edge password-reset flow and how active sessions are stored or invalidated. Add a regression test for a password reset through the proxy, then verify that the affected users' existing sessions are no longer valid while the reset flow still succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100