Reset a password only once #44922
Reset a password only once #44922
Conversation
1ff90ac to
c6081fd
Compare
Closes keycloak#37231 Signed-off-by: Alexander Schwartz <[email protected]>
c6081fd to
c897d7b
Compare
|
@pruivo - this touches the revoked token mechanism and applies it to reset password. Can you please have look at the ISPN parts? Let me know if you are OK to review the other parts as well, or if I should look for someone else. Thanks! |
pruivo
left a comment
There was a problem hiding this comment.
ISPN changes look fine to me 👍
|
@rmartinc - May I ask you for a review of this PR? Thanks! |
rmartinc
left a comment
There was a problem hiding this comment.
Thanks @ahus1! I tested this and it works OK for me. I thought that that doing this we could have issues with email scanners, but your solution is OK. It re-checks the token at the end, so no problem if the URL is scanned. Just a minor comment in the test. I prefer to check the reset password and the error. I approved it, but consider adding the checks in the test.
...tion-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetPasswordTest.java
Show resolved
Hide resolved
…keycloak/testsuite/forms/ResetPasswordTest.java Co-authored-by: Ricardo Martin <[email protected]> Signed-off-by: Alexander Schwartz <[email protected]>
Closes #37231