fix: Add route for user to change own password #1812
Conversation
8ed6960 to
13e4b22
Compare
e828fb3 to
f1e430a
Compare
| // we want to require old_password field if the user is changing their | ||
| // own password. This is to prevent a compromised session from being able | ||
| // to change password and lock out the user. |
There was a problem hiding this comment.
Is this security through obscurity? A highjacked admin session could still reset everyone's passwords.
There was a problem hiding this comment.
Not exactly, it's to prevent a leaked admin token from being able to lock the admin out. They could reset other people's passwords, but not the admin themselves. It's a small scope but makes sense to do I think.
There was a problem hiding this comment.
It's mainly reusing the same endpoint for reset & change. I think the security implications are not even a consideration at this stage. Admins have some super powers that we don't need to tighten for MVP
| // we want to require old_password field if the user is changing their | ||
| // own password. This is to prevent a compromised session from being able | ||
| // to change password and lock out the user. |
There was a problem hiding this comment.
It's mainly reusing the same endpoint for reset & change. I think the security implications are not even a consideration at this stage. Admins have some super powers that we don't need to tighten for MVP
Backend for #1819