search

npm / www

community space for the npm website
https://npm.community
69 stars 48 forks source link

Automatic Login for Deleted Account #382

Open qtapostate opened 6 years ago

qtapostate commented 6 years ago

Link to the page

http://npmjs.com/

Logged in or logged out?

Logged in

Expected behavior

Should not be able to browse on a deleted account.

Actual behavior

Account was deleted by support but it still works. My best guess is that when support deletes an account for a migration existing JWTs do not get invalidated.

Steps to reproduce the problem

  1. Create a new account
  2. Log in using "remember me"
  3. Request support to delete this account (for a migration)
  4. Close browser window
  5. Wait for support to delete account (and migrate packages)
  6. Open browser window again, you should be logged in on your supposedly deleted account

Browser with version

Firefox for Ubuntu (canonical - 1.0), v59.0.2 (64-bit)

Any error message?

No.