Comments (3)
Well, I guess the token contains the email, and that is used as the security principal.... if the email is the same, the token still validates and has no awareness (nor it needs to have) of the user ID. I don't see this as a security concern, to be honest... let's see what the author thinks.
from simple-jwt-login.
In my case, both id
and email
are in the JWT payload (corresponding checkboxes are checked in the JWT Payload parameters option in the Authentication section).
Probably there is no comparison between token fields and fields returned from the WordPress function that searches for a user by email.
from simple-jwt-login.
I agree with @dani3l3. This is how this plugin works ( search a user by the payload).
I believe that, if you invalidate the JWT after you delete the user, will solve your issue.
This way, you can make sure that the JWT generated by this user, will not be valid to access the newly created user.
Also, you can set an expiration time, for the JWTs.
But, I would suggest you use the ID instead of the email.
from simple-jwt-login.
Related Issues (20)
- WordPress update failure HOT 4
- feature: Settings import/export tool HOT 3
- openssl_sign(): supplied key param cannot be coerced into a private key HOT 1
- bug: Able to read protected endpoints with revoked tokens. HOT 3
- feature: Endpoint user Info HOT 3
- How to set token expirations based on User Role HOT 2
- bug: Not working with woocommerce end point HOT 3
- bug: Fatal Error after fresh install from wordpress.com
- bug: Auto login doesn't work for first time HOT 3
- bug: 502 Bad Gateway while working with woocommerce REST API HOT 1
- bug: Docs ”simple_jwt_login_before_endpoint“ hook example HOT 1
- feature: Add extra information for Hooks checkboxes
- bug: Meta data does not save in create use endpoint HOT 3
- Add PR Welcome badge HOT 1
- bug: update password route (PUT) responses are inconsistent
- bug: update password route (PUT) responses are inconsistent HOT 1
- bug: Invalid email while register HOT 1
- feature: Parse only Bearer tokens and or unnamed tokens
- feature: social login/register integration HOT 2
- bug: performance issue 500ms -> 4000ms when check endpoints
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from simple-jwt-login.