Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix bug regarding token deletions upon successful password resets #5724

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix bug regarding token deletions upon successful password resets #5724

wants to merge 1 commit into from

Commits on Feb 14, 2024

  1. Delete only password reset tokens upon success 

    In the default authentication system created by the `mix phx.gen.auth`,
when a password has been successfully reset, it deletes all of the
tokens regardless of their context, however, this is problematic in the
following scenario:

- A user has been registered, which creates a token with the `confirm`
  context and account confirmation instructions delivered via email.
- The user has not clicked on the confirmation email message yet.
- The user requests password reset instructions and gets them via email.
- The user successfully follows the password reset instructions.
- The user tries to click on the confirmation email, but it is no longer
  valid.

By scoping the deletion to only `reset_password` tokens, the bug is gone
and the confirm token will still be valid regardless of the abovementioned
process.
    @roberto-aguilar
    roberto-aguilar committed Feb 14, 2024
    Configuration menu
    Copy the full SHA
    6bb80a9 View commit details
    Browse the repository at this point in the history