Security: OAuth token non revokable #320

Closed
opened 2018-10-12 23:33:46 +00:00 by nik · 1 comment
Member

In the scenario that your OAuth token has been stolen by a malicious client there is no way to revoke it/all tokens.

Potential immediate fixes: changing password should revoke all tokens(?) or maybe a button in pleroma-fe/settings/security to revoke all tokens

In the scenario that your OAuth token has been stolen by a malicious client there is no way to revoke it/all tokens. Potential immediate fixes: changing password should revoke all tokens(?) or maybe a button in pleroma-fe/settings/security to revoke all tokens
Owner

Clearing tokens when changing the password is quite a usual way of doing it, I think if we add anything about to the UI it’s more like a revoke-button on each token so it’s worth it.

Clearing tokens when changing the password is quite a usual way of doing it, I think if we add anything about to the UI it’s more like a revoke-button on each token so it’s worth it.
Sign in to join this conversation.
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/pleroma#320
No description provided.