Project

General

Profile

Actions
Copy link

Feature #44578

closed

Invalidate sessions and autologin tokens when an email address is changed or deleted

Added by Jens Krämer 23 days ago. Updated 16 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Go MAEDA
Category:
Accounts / authentication
Target version:
6.1.6
Resolution:
Fixed

Description

So far, changing or deleting an email address of a user deleted only their
password recovery tokens.
With this change, as defense in depth against hijacked
sessions, it now deletes their auto login and session tokens as well, like a
password change does, so that all sessions of the user end.

Files

0001-Invalidate-sessions-and-autologin-tokens-when-an-ema.patch (20.3 KB) 0001-Invalidate-sessions-and-autologin-tokens-when-an-ema.patch Jens Krämer, 2026-10-06 07:28
Actions
Copy link

Also available in: Atom PDF