Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add "options" flag to disable access token invalidation #3071

Closed
bajtos opened this issue Jan 5, 2017 · 4 comments · Fixed by #4021
Closed

Add "options" flag to disable access token invalidation #3071

bajtos opened this issue Jan 5, 2017 · 4 comments · Fixed by #4021

Comments

@bajtos
Copy link
Member

bajtos commented Jan 5, 2017

Invalidating all access tokens on every change of email/password is a bit cumbersome for users. The invalidation was added to allow users to recover after their email/password was stolen. IMO, users usually change their email/password for different reasons and in most cases do not want their other sessions to be logged out.

I am proposing to modify the current implementation to recognize a new flag set via method "options" argument, allowing LoopBack apps to offer the user a choice whether to invalidate other sessions or not.

// sample usage in a custom remote method
Customer.prototype.changePassword = function(newPass, invalidateAccessTokens, options, cb) {
  var data = { password: newPass };
  options.invalidateAccessTokens = invalidateAccessTokens;
  this.updateAttributes(data, options, cb);
};

See also #3034.

@bajtos
Copy link
Member Author

bajtos commented Jan 24, 2017

On the second thought, this is a great "first commit" task for people wanting to start contributing to LoopBack. I have added patch-welcome label and removed P1.

@barocsi
Copy link

barocsi commented Feb 27, 2017

It would be great to just have some methods so we can override the hook registration of some email and password related stuff. It can be pretty blocking when you have a slightly but not completely different implementation.

@lchaglla
Copy link
Contributor

lchaglla commented Oct 4, 2018

Can I try to fix this, I mean is it still open?

@bajtos
Copy link
Member Author

bajtos commented Oct 5, 2018

@lchaglla thank you for chiming in! This issue hasn't been fixed yet so yes, it's still open for contribution.

However: we are planning to release LoopBack 4 next week, after which LoopBack 3 moves to Active LTS and no new features will be accepted anymore. I am not sure how likely it is to get your contribution into a shape when it can be landed by that time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants