graphile / starter

Opinionated SaaS quick-start with pre-built user account and organization system for full-stack application development in React, Node.js, GraphQL and PostgreSQL. Powered by PostGraphile, TypeScript, Apollo Client, Graphile Worker, Graphile Migrate, GraphQL Code Generator, Ant Design and Next.js
https://graphile-starter.herokuapp.com
Other
1.74k stars 219 forks source link

security: delete sessions after password change/reset #277

Closed benjie closed 2 years ago

benjie commented 2 years ago

Description

In addition to the existing behaviour of sending a user a security alert to notify them that their password has been changed/reset, this PR signs out all other sessions in the hope that the user is more likely to notice something is amiss sooner.

Fixes #276

Performance impact

Not one we care about.

Security impact

Extremely marginal improvement in security with accompanying increase in user frustration - there's always a trade-off between security and convenience.