Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #15065 Changing password should revoke all OAuth2 tokens
    Actions
    Infos
    #15065
    Thomas Gerbet (tgerbet)
    2020-07-07 10:30
    2020-07-03 14:01
    16334
    Details
    Changing password should revoke all OAuth2 tokens
    If a user's account is compromised by an attacker, the attacker could try to persist some of its accesses by registering an evil OAuth2 app into the account. By revoking all the ongoing OAuth2 tokens we make sure the user has purposely wanted to share its access with the app at least once.
    OAuth2 / OpenID Connect server
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Closed
    2020-07-07
    Attachments
    Artifact links

    Releases

    Fixed in

    Artifact ID Project Tracker Summary Status Last Update Date Submitted By Assigned to
    rel #14817 Tuleap Releases 11.17 Delivered 2020-07-23 10:57 Manuel Vacelet (vaceletm)
    Empty
    References
    Referencing request #15065

    Git commit

    tuleap/tuleap/stable

    Merge commit 'refs/changes/47/19447/3' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD 2ae36ef0c2
    User avatar Joris MASSON (jmasson) , 2020-07-07 10:28
    request #15065: Changing password should revoke all OAuth2 tokens b88cbd3979
    User avatar Thomas Gerbet (tgerbet) , 2020-07-07 09:29
    Referenced by request #15065

    Artifact Tracker v5

    rel #14817 11.17

    Other

    gerrit #19447
    Display settings

    Follow-ups