require existing password to change password with session (not reset flow)

keratin / authn

Prototype version of AuthN service. See: keratin/authn-server

https://keratin.tech

GNU Lesser General Public License v3.0

34 stars 0 forks source link

require existing password to change password with session (not reset flow) #48

Closed cainlevy closed 7 years ago

cainlevy commented 7 years ago

When changing a password using the session, Keratin AuthN should require the existing password. This is standard practice to prevent someone from getting locked out of their account if they walk away from an unsecured computer.