Project

General

Profile

Actions
Copy link

Feature #44578

closed

Invalidate sessions and autologin tokens when an email address is changed or deleted

Added by Jens Krämer 22 days ago. Updated 16 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Go MAEDA
Category:
Accounts / authentication
Target version:
6.1.6
Resolution:
Fixed

Description

So far, changing or deleting an email address of a user deleted only their
password recovery tokens.
With this change, as defense in depth against hijacked
sessions, it now deletes their auto login and session tokens as well, like a
password change does, so that all sessions of the user end.

Files

0001-Invalidate-sessions-and-autologin-tokens-when-an-ema.patch (20.3 KB) 0001-Invalidate-sessions-and-autologin-tokens-when-an-ema.patch Jens Krämer, 2026-10-06 07:28
Actions
Copy link
 #1

Updated by Go MAEDA 22 days ago

  • Category set to Accounts / authentication
  • Target version set to Candidate for next minor release
Actions
Copy link
 #2

Updated by Go MAEDA 20 days ago

  • Target version changed from Candidate for next minor release to 6.1.6

Setting the target version to 6.1.6.

Actions
Copy link
 #3

Updated by Go MAEDA 18 days ago

  • Tracker changed from Patch to Feature
  • Resolution set to Fixed

Committed the patch in r25225. Thank you.

Actions
Copy link
 #4

Updated by Go MAEDA 18 days ago

  • Assignee set to Go MAEDA
Actions
Copy link
 #5

Updated by Go MAEDA 16 days ago

  • Status changed from New to Closed

Merged the change into the stable branches in r25233 and r25234.

Actions
Copy link

Also available in: Atom PDF