Reset Password - MailGun & Parse-Server doesn't expire session #3265

Activity

1. fcoufour commented on Jan 30, 2017

   

   fcoufour

   on Jan 30, 2017

   More actions

   Hi Sricharan,

   Same issue here with Parse Server 2.2.25. Modifying the password when logged in revokes the session as intended. The session is however not revoked after the success of the email reset procedure.

   It seems that the revoke session logic is located in the RestWrite.js file:

   // Handles any followup logic
   RestWrite.prototype.handleFollowup = function() {
     if (this.storage && this.storage['clearSessions'] && this.config.revokeSessionOnPasswordReset) {
       var sessionQuery = {
         user: {
           __type: 'Pointer',
           className: '_User',
           objectId: this.objectId()
         }
       };
       delete this.storage['clearSessions'];
       return this.config.database.destroy('_Session', sessionQuery)
       .then(this.handleFollowup.bind(this));
     }
   
     if (this.storage && this.storage['generateNewSession']) {
       delete this.storage['generateNewSession'];
       return this.createSessionToken()
       .then(this.handleFollowup.bind(this));
     }
   
     if (this.storage && this.storage['sendVerificationEmail']) {
       delete this.storage['sendVerificationEmail'];
       // Fire and forget!
       this.config.userController.sendVerificationEmail(this.data);
       return this.handleFollowup.bind(this);
     }
   };
   

   clearSessions is previously set to true only if not master and this probably the reason why the behaviour is the same as Parse Dashboard (issue #3289):

   if (this.query && !this.auth.isMaster) {
     this.storage['clearSessions'] = true;
     this.storage['generateNewSession'] = true;
   }
   

   Can anyone confirm?
2. hramos commented on Feb 10, 2017

   

   hramos

   on Feb 10, 2017

   Contributor

   More actions

   Hey, thanks for reporting this issue.

   Can you please add all the info specified in the template? This is necessary for people to be able to understand and reproduce the issue being reported.
3. hramos

   closed this as completedon Feb 10, 2017