View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0009651 | Taler | merchant backend | public | 2025-03-23 18:43 | 2025-12-07 09:53 |
| Reporter | schanzen | Assigned To | schanzen | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | feature | Reproducibility | have not tried |
| Status | implementing | Resolution | open | ||
| Product Version | 1.0 | ||||
| Target Version | post-1.0 | ||||
| Summary | 0009651: When changing the instance password we may want to revoke old access tokens | ||||
| Description | Currently, unless the tokens expire or are explicitly revoked, they stay valid even if the instance password is changed. We may want to think about revoking all old tokens issued before the change. | ||||
| Tags | security | ||||
| related to | 0009556 | closed | Christian Grothoff | address merchant auth token weirdness |
| I think this should be an option. Just because someone changes their instance password doesn't mean that they intend to revoke all access tokens. So the SPA could have a checkbox "revoke access tokens" and submit that boolean with the password change request. I guess the safe(r) default is to set it by default, but I think there are legitimate cases where you want the access tokens to remain valid, so we should give users a way to disable that. | |
| Suggest to add this as a feature for 1.2 | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-03-23 18:43 | schanzen | New Issue | |
| 2025-03-23 18:43 | schanzen | Status | new => assigned |
| 2025-03-23 18:43 | schanzen | Assigned To | => Christian Grothoff |
| 2025-03-23 18:43 | schanzen | Relationship added | related to 0009556 |
| 2025-03-24 12:47 | Christian Grothoff | Note Added: 0024295 | |
| 2025-03-24 12:47 | Christian Grothoff | Assigned To | Christian Grothoff => schanzen |
| 2025-04-17 20:36 | Christian Grothoff | Tag Attached: security | |
| 2025-05-08 20:30 | Christian Grothoff | Target Version | 1.1 => post-1.0 |
| 2025-06-19 20:31 | schanzen | Severity | minor => feature |
| 2025-06-19 20:31 | schanzen | Target Version | post-1.0 => 1.6 |
| 2025-06-19 20:31 | schanzen | Note Added: 0025287 | |
| 2025-08-31 17:36 | Christian Grothoff | Product Version | => 1.0 |
| 2025-08-31 17:36 | Christian Grothoff | Target Version | 1.6 => post-1.0 |
| 2025-12-07 09:53 | Christian Grothoff | Status | assigned => implementing |