josevalim

josevalim

Creator of Elixir

Oh, our confirmation route does not sign the user in, so it does not need to be treated as a session. I guess we could delete all except confirmation by replacing the atom :all by :except_confirm and then changing the token schema module accordingly. Would you like to send a PR?

0
Post #11
silverdr

silverdr OP

Yes - I still have one or two more small things scheduled already so I’ll add it to my list. This should go against 1.6, right? Still - generally I would delete only the directly relevant tokens. The reason being that I perceive the token mechanism introduced in phx_auth_gen as a generic one, which can be used to safeguard other actions in a larger application context. In such case – as a user – I wouldn’t be too happy if I couldn’t authenticate those actions out of a sudden. I mentally probably wouldn’t even connect my password reset with other things not working as they should. IOW I’d rather whitelist the contexts instead of blacklisting them. WDYT?

0
Post #12
josevalim

josevalim

Creator of Elixir

The flip side is that there are then some tokens that should be discarded and now you forgot about them, opening up a potential security flaw. :slight_smile: Plus the “change:…” tokens would require some sort of prefix query. So I think we should explicit list the ones we want to keep.

0
Post #13
silverdr

silverdr OP

Roger that.

What exactly do you mean here?

0
Post #14
josevalim

josevalim

Creator of Elixir

The change email tokens have “change:#{email}” as context.

0
Post #15
— All posts loaded —