search

Firesphere / silverstripe-graphql-jwt

JWT Authentication for GraphQL
GNU General Public License v3.0
19 stars 24 forks source link

Correct username + correct Token + incorrect password #6

Closed Firesphere closed 7 years ago

Firesphere commented 7 years ago

This returns as valid user based on the token, it should invalidate the whole session and token.

Firesphere commented 7 years ago

This is expected behaviour, the member gets an anonymous token, to act as "logged in without privileges", canView on any object requiring a member to be logged in will return false as it's ID is 0

Slightly confusing, but a feature that's somewhat needed

Firesphere commented 7 years ago

Added the feature to disable anonymous login. See https://github.com/firesphere/silverstripe-graphql-jwt/commit/46ef3e61e4894fdd0788da85690581711661cdff