If password changes, session is still valid. about aura.auth

[cxj]

How would the Auth object be notified that the password had been changed? That seems like an external operation.

Perhaps there should be an Aura.Auth public method for intentionally invalidating a session? Such a method would then be called by application code which changes the password.

[jakejohns]

Isn't the LogoutService the way to invalidate a session?

I don't agree that a change in the credential persistence necessarily
invalidates a session. I don't want to authenticate again if I change my
password.

If you really wanted the implied functionality, I think you'd modify your use of
the ResumeService with some conditional logic that checks the last auth time
against the last change in the credential persistence? Whatever you did, you'd
be hitting the credential persistence on every request tho, so it doesn't seem
that great.

[azaiter]

My initial idea is to have something like what @jakejohns mentioned on editing ResumeService. But it will add more overhead to the checking mechanism (implied login on each time the session is validated). Sometimes this could be essential in a "higher" security system. After seeing your opinion on this, I'm not sure if this could be another functionality request or just close it out as it could be not necessary.

[harikt]

3- Check auth->isValid() is also still true.

Once you use the credentials the validity is verified at the time only. So it no longer checks the password you entered .

But since the password is invalid, the session should be invalidated.

You can do this via logging out the user when the password is changed as @jakejohns already mentioned.

This is outside the scope of this library.