saret/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.wiki.git synced 2026-07-25 00:53:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Rotate refresh-tokens on sstamp reset (#7031)

Browse Source 
When a security-stamp gets reset/rotated we should also rotate all device refresh-tokens to invalidate them.
Else clients are still able to use old refresh tokens.

Signed-off-by: BlackDex <black.dex@gmail.com>
This commit is contained in:
Mathijs van Veluw
2026-03-29 22:43:36 +02:00
committed by GitHub
parent 3a1378f469
commit f62a7a66c8
6 changed files with 46 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/core/emergency_access.rs
+1 -1
View File
@@ -653,7 +653,7 @@ async fn password_emergency_access(
};
// change grantor_user password
grantor_user.set_password(new_master_password_hash, Some(data.key), true, None);
grantor_user.set_password(new_master_password_hash, Some(data.key), true, None, &conn).await?;
grantor_user.save(&conn).await?;
// Disable TwoFactor providers since they will otherwise block logins