Check suspended credentials before login and password reset

TeskaLabs / seacat-auth

SeaCat Auth provides authentication, authorization, identity management, session management and other access control features.

GNU General Public License v3.0

11 stars 6 forks source link

Closed byewokko closed 6 months ago

byewokko commented 6 months ago

The suspended status is checked at the beginning of the login process, at login prologue time.
CRITICAL Password reset is now disabled for suspended credentials. The check is performed both before the reset token is created and before the password is changed.