groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-27 03:31:46 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

User password changes invalidate sessions

Browse source
This commit is contained in:
advplyr 2026-07-23 17:21:25 -05:00
parent a6cde926ee
commit c900676be7
5 changed files with 112 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

20
server/controllers/MeController.js
View file

@ -351,6 +351,8 @@ class MeController {
* User change password. Requires current password.
* Guest users cannot change password.
*
* Invalidates all other JWT sessions for the user. If using x-refresh-token, returns new tokens for the current session.
*
* @this import('../routers/ApiRouter')
*
* @param {RequestWithUser} req
@ -373,6 +375,24 @@ class MeController {
return res.status(400).send(result.error)
}
const shouldReturnTokens = !!req.headers['x-refresh-token']
const newTokens = await this.auth.invalidateJwtSessionsForUser(req.user, req, res)
if (newTokens?.accessToken) {
Logger.info(`[MeController] Invalidated other JWT sessions for user ${req.user.username} after password change`)
if (shouldReturnTokens) {
return res.json({
success: true,
user: {
accessToken: newTokens.accessToken,
refreshToken: newTokens.refreshToken
}
})
}
} else {
Logger.info(`[MeController] Invalidated all JWT sessions for user ${req.user.username} after password change`)
}
res.sendStatus(200)
}