sourcefuse / sourcefuse/loopback4-microservice-catalog
authentication-service: All user sessions should be expired when user's password is updated
Open
@Sourav-kashyap is already working on this.
Since Jun 10, 2026.
- Dominant language
- TypeScript
- Stars
- 297
- Forks
- 78
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 4
Description
Is your feature request related to a problem? Please describe.
This has been reported as a security vuknerability.
Describe the solution you'd like
When the password of a user is updated, all the ongoing session of the user must expire.
Try to implement a provider for this, in case it can be override
Describe alternatives you've considered
Since the auth flow is stateless, this can be checked during token refresh when the access token gets expireds
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.