Comments (4)
How would the Auth object be notified that the password had been changed? That seems like an external operation.
Perhaps there should be an Aura.Auth public method for intentionally invalidating a session? Such a method would then be called by application code which changes the password.
from aura.auth.
Isn't the LogoutService
the way to invalidate a session?
I don't agree that a change in the credential persistence necessarily
invalidates a session. I don't want to authenticate again if I change my
password.
If you really wanted the implied functionality, I think you'd modify your use of
the ResumeService
with some conditional logic that checks the last auth time
against the last change in the credential persistence? Whatever you did, you'd
be hitting the credential persistence on every request tho, so it doesn't seem
that great.
from aura.auth.
My initial idea is to have something like what @jakejohns mentioned on editing ResumeService
. But it will add more overhead to the checking mechanism (implied login on each time the session is validated). Sometimes this could be essential in a "higher" security system. After seeing your opinion on this, I'm not sure if this could be another functionality request or just close it out as it could be not necessary.
from aura.auth.
3- Check auth->isValid() is also still true.
Once you use the credentials the validity is verified at the time only. So it no longer checks the password you entered .
But since the password is invalid, the session should be invalidated.
You can do this via logging out the user when the password is changed as @jakejohns already mentioned.
This is outside the scope of this library.
from aura.auth.
Related Issues (20)
- 4.0.0 Release? HOT 2
- PHP 7.4 compatibility HOT 3
- Add ldap bind user HOT 13
- Release and without fear to use HOT 1
- PDO: Thrown exception error messages HOT 6
- Auth object calling session_start HOT 1
- Rehash HOT 2
- Does HtpasswordVerifier need to verify the password hash is buggy and using bcrypt ? HOT 1
- Better ways to handle brute force attack
- Sessions, remember me functionality and other things. HOT 1
- Can't use minimum-stability: stable with this package HOT 2
- Adapter in resume HOT 1
- Probably good to have messages passed for Exceptions ? HOT 3
- LdapAdapter::bind performs a double unbind on the underlying ldap resource HOT 2
- Default timeout values HOT 3
- Missing return values, or changed API and docblock out of date? HOT 4
- Aura.Session compatibility HOT 12
- Unable to logout HOT 1
- New release builds, please? HOT 14
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aura.auth.