Repository navigation
Session not revoked when user password changes using Parse Dashboard #3289
Description
Session is not being revoked when the user's password is changed from Parse Dashboard.
Code Ref
I noticed that the condition being checked is: if (this.query && !this.auth.isMaster), which means only non-Master authentication would allow sessions to be revoked. What about when master authentication is changing the user's password (e.g. Parse Dashboard)
Steps to reproduce
- Create a user in dashboard.
- Login the user using a rest call, which generates a session for the user.
- Go to dashboard and change the user's password.
- Observe that the Session for that user is not revoked.
Expected Results
According to the Parse Server defaults, the session is supposed to be revoked.
Actual Outcome
The session is not being revoked
Environment Setup
-
Server
- parse-server version (Be specific! Don't say 'latest'.) : 2.2.24
- Operating System: MacOS
- Hardware:
- Localhost or remote server? Localhost
-
Database
- MongoDB version: v3.2.1
- Storage engine: WiredTiger
- Localhost or remote server? Localhost
Activity
sricharan123 commentedon Dec 27, 2016
same issue raised, i got the same problem. issue #3265 .
flovilmart commentedon May 16, 2017
@anashalb thanks for the info.
I'll fix this behaviour which is not intended.
Adds repro to issue #3289
Always clear sessions when user password is updated (#3821)
pjbrigden commentedon Jun 2, 2017
Hey guys, do you think this issue will be resolved in the next Parse Server release? Keep up the good work!
flovilmart commentedon Jul 23, 2017
This has been merged and released, please re-open the issue if tis persists.