Auth: Password reset #40

New Issue

niggl · 2020-12-20T16:43:40Z

niggl commented

2020-12-20 16:43:40 +00:00

We probably want our users to have a pw reset route that does stuff based on sending reset links (even if it just returns those links for now instead of sending them via mail)

niggl referenced this issue from a commit

2020-12-22 09:28:07 +00:00

Added pw reset jwt generation

niggl referenced this issue from a commit

2020-12-22 09:38:49 +00:00

Added a basic pw reset action

niggl referenced this issue from a commit

2020-12-22 09:39:18 +00:00

Added a password reset token request route

niggl referenced this issue from a commit

2020-12-22 09:39:42 +00:00

Renamed the password reset token creation class to better fit the scheme

niggl referenced this issue from a commit

2020-12-22 09:44:44 +00:00

Renamed the return variable to fit the class

niggl referenced this issue from a commit

2020-12-22 09:57:09 +00:00

Implemented basic password reset

niggl referenced this issue from a commit

2020-12-22 09:57:25 +00:00

Implemented toe password reset route

niggl added the

status:doing

label 2020-12-22 09:57:40 +00:00

niggl self-assigned this 2020-12-22 09:57:43 +00:00

niggl commented

2020-12-22 09:59:32 +00:00

I implemented the basic password reset stuff.
Right now it just return's the reset token on request and you can just spam request reset tokens.
Next up I'm gonna implement a reset requesting timeout.

I implemented the basic password reset stuff. Right now it just return's the reset token on request and you can just spam request reset tokens. Next up I'm gonna implement a reset requesting timeout.

niggl referenced this issue from a commit

2020-12-22 10:07:01 +00:00

Set reset token expiry to 15 mins

niggl referenced this issue from a commit

2020-12-22 10:12:25 +00:00

Implemented a password reset timeout

niggl referenced this issue from a commit

2020-12-22 10:18:32 +00:00

Now disableing users while they're in the process of resetting their password

niggl referenced this issue from a commit

2020-12-22 10:20:11 +00:00

Removed bs enabled check

niggl referenced this issue from a commit

2020-12-22 10:27:21 +00:00

Fixed weired query behaviour

niggl referenced this issue from a commit

2020-12-22 10:27:21 +00:00

Users now can be disabled from the start

niggl referenced this issue from a commit

2020-12-22 10:29:54 +00:00

All things auth now check if the user is disabled

niggl referenced this issue from a commit

2020-12-22 10:35:33 +00:00

Removed the user disableing

niggl commented

2020-12-22 10:44:49 +00:00

I implemented checks and errors for the following:

Is the user disabled (login, refresh, autorefresh and reset request)?
Has the user requested another refresh in the last 15min?

And i have a question: What is your opinion on disabling user login for a user while their password reset is in progress? I don't really think we should prevent them from doing this but it certainly is an option.

I implemented checks and errors for the following: * Is the user disabled (login, refresh, autorefresh and reset request)? * Has the user requested another refresh in the last 15min? And i have a question: What is your opinion on disabling user login for a user while their password reset is in progress? I don't really think we should prevent them from doing this but it certainly is an option.

niggl referenced this issue from a commit

2020-12-22 10:48:06 +00:00

Added comments

niggl referenced this issue

2020-12-22 15:02:29 +00:00

Release a new alpha version #47

niggl added a new dependency 2020-12-22 15:04:17 +00:00

#45 Create automated tests for login related stuff

niggl referenced a pull request that will close this issue

2020-12-22 15:04:49 +00:00

feature/40-pw_reset #48

niggl referenced this issue from a commit