Oh, our confirmation route does not sign the user in, so it does not need to be treated as a session. I guess we could delete all except confirmation by replacing the atom :all by :except_confirm and then changing the token schema module accordingly. Would you like to send a PR?
josevalim
Creator of Elixir
0
silverdr
Yes - I still have one or two more small things scheduled already so I’ll add it to my list. This should go against 1.6, right? Still - generally I would delete only the directly relevant tokens. The reason being that I perceive the token mechanism introduced in phx_auth_gen as a generic one, which can be used to safeguard other actions in a larger application context. In such case – as a user – I wouldn’t be too happy if I couldn’t authenticate those actions out of a sudden. I mentally probably wouldn’t even connect my password reset with other things not working as they should. IOW I’d rather whitelist the contexts instead of blacklisting them. WDYT?
0
josevalim
Creator of Elixir
The flip side is that there are then some tokens that should be discarded and now you forgot about them, opening up a potential security flaw. 
Plus the “change:…” tokens would require some sort of prefix query. So I think we should explicit list the ones we want to keep.
0
silverdr
josevalim
Creator of Elixir