search

gentics / mesh-incubator

Project which is home for planned enhancements for Gentics Mesh
3 stars 0 forks source link

Update reset_token behaviour #143

Open Jotschi opened 6 years ago

Jotschi commented 6 years ago

The reset_token should only be issued if the issuer can update the user. After that the token should be enough to update the user using the token. No extra user / role perm should be needed.

Currently the user editor is used to authenticate permissions. (see UserTokenAuthHandler#83)