anitab-org / anitab-org/mentorship-backend
Bug: Valid Refresh Tokens despite user changing password
Đang mở
Category: Coding
Type: Bug
- Ngôn ngữ chính
- Python
- Star
- 200
- Fork
- 449
- Chỉ số merge pull request
- Không có pull request nào được merge trong 30 ngày
Mô tả
**Describe the bug**
Refresh Tokens are still valid even after the user changes passwords.
**To Reproduce**
Steps to reproduce the behavior:
1. Login and save the refresh token you get.
2. Change password
3. Scroll down to Refresh endpoint and use the old Refresh token.
4. See error
**Expected behavior**
Refresh Tokens should not be valid after a user changes passwords.
**Additional context**
This can be done by using the users hashed password as the secret for the refresh tokens.
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.