search

ledgerconnect / steemconnect

Signer app for Steem
https://steemconnect.com
MIT License
159 stars 88 forks source link

Steemconnect session is maintained even when password is changed externally #359

Closed economicstudio closed 5 years ago

economicstudio commented 5 years ago

I've changed my master password on Steemit.com, but Steemconnect session was maintained. For instance, I can still use Busy.org (which uses Steemconnect for login session) without re-login. This would be vulnerable when password is actually hacked. All session should be expired with password change.

economicstudio commented 5 years ago

https://steemit.com/utopian-io/@blockchainstudio/steemconnect-sessions-should-expire-when-a-password-is-changed

bonustrack commented 5 years ago

This is solved on the new version of steemconnect at https://beta.steemconnect.com/ . Access tokens are now created on front-end by signing a message with user Steem account key, if the user change his key the access_token will not be pass the validation anymore on SteemConnect API. Feel free to open another issue if you still having issue.