rhino/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-04-03 07:39:20 -07:00
Code Issues Packages Projects Releases Wiki Activity

Rotate refresh-tokens on sstamp reset (#7031)

Browse Source 
When a security-stamp gets reset/rotated we should also rotate all device refresh-tokens to invalidate them.
Else clients are still able to use old refresh tokens.

Signed-off-by: BlackDex <black.dex@gmail.com>
This commit is contained in:
Mathijs van Veluw
2026-03-29 22:43:36 +02:00
committed by GitHub
parent 3a1378f469
commit f62a7a66c8
6 changed files with 46 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/api/core/organizations.rs
View File

@@ -2858,7 +2858,8 @@ async fn put_reset_password(
let reset_request = data.into_inner();
let mut user = user;
user.set_password(reset_request.new_master_password_hash.as_str(), Some(reset_request.key), true, None);
user.set_password(reset_request.new_master_password_hash.as_str(), Some(reset_request.key), true, None, &conn)
.await?;
user.save(&conn).await?;
nt.send_logout(&user, None, &conn).await;