PedroBern / django-graphql-auth

Django registration and authentication with GraphQL.
https://django-graphql-auth.readthedocs.io/en/latest/
MIT License
329 stars 106 forks source link

Password reset link can be used multiple times #148

Open LinnaViljami opened 2 years ago

LinnaViljami commented 2 years ago

Prerequisites

Description

Password reset link (reset token) should be revoked after resetting the password with it. Resetting password multiple times using same link should not be possible

Steps to Reproduce

  1. Register new user
  2. Request password reset link
  3. Reset password first time
  4. Reset password again with the link

Expected behavior

When trying to use same link multiple times password should not reset again

Actual behavior

Password reset multiple times using same token