Açık Kapalı

Change Password Force Fully Logout Other sessions of that user #6750

User avatar
0
dipak.z oluşturuldu
  • ABP Framework version: v5.2.1
  • UI Type: MVC
  • Database System: EF Core ( PostgreSQL)
  • Tiered (for MVC) or Auth Server Separated (for Angular): no
  • Exception message and full stack trace:
  • Steps to reproduce the issue:

-> When User Change Own Password then another sessions of that user force fully logout(this issue show in vulnerability tool report.)

Kabul edilen cevaba git
3 Cevap
  • User Avatar
    0
    maliming oluşturuldu
    Destek Takımı Fullstack Developer

    hi

    You can try to set ValidationInterval of SecurityStampValidatorOptions. The default is 30 minutes.

    If this value is too small, it may affect performance.

    https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.identity.securitystampvalidatoroptions.validationinterval?view=aspnetcore-8.0

  • User Avatar
    0
    dipak.z oluşturuldu

    Any other way because portal is too slow when i put 1 minute

    i have to solve because its show as vulnerability.

  • User Avatar
    0
    maliming oluşturuldu
    Destek Takımı Fullstack Developer

    hi

    There is no good solution, we can only periodically check in the request if the user has changed the password.

    You can override the SecurityStampValidator.ValidatePrincipalAsync method to validate it yourself in other ways.

    https://github.com/dotnet/aspnetcore/blob/release/8.0/src/Identity/Core/src/SecurityStampValidator.cs#L129-L163

Atanan
User avatar maliming
Etiketler
Henüz bulunmuyor
Made with ❤️ on ABP v8.2.0-preview Updated on Mart 25, 2024, 15:11