search

zulip / zulip

Zulip server and web application. Open-source team chat that helps teams stay productive and focused.
https://zulip.com
Apache License 2.0
21.57k stars 7.83k forks source link

auth: Add a proper re-authentication flow for dangerous actions. #6341

Open rishig opened 7 years ago

rishig commented 7 years ago

Currently if you want to view your API key, you need to enter your password. However, if you made an account with google auth, you won't have a password, so you instead have to create a password for the explicit purpose of getting access to your API key.

The solution is to have the auth for API key be a reauthentication flow that allows you to auth with google auth, ldap, or however you normally authenticate.

You can access the current flow at the bottom of https://chat.zulip.org/#settings/your-account

This is a somewhat tricky change, suitable for someone with experience developing for Zulip.

zulipbot commented 7 years ago

Hello @zulip/server-authentication, @zulip/server-bots members, this issue was labeled with the area: authentication, area: bots labels, so you may want to check it out!

alexmv commented 2 years ago

I've updated this title to account for the fact that it should also cover actions that are irreversible without contacting support -- namely, deactivating one's own account, and deactivating the organization.