← All plugin changes

sm-user-plugin 0.1.13

v0.1.131 min readPlugins

Highlights

sm-user-plugin 0.1.13 hardens device authorization and the admin Reset 2FA action.

Fixed

  • Revoking a device can no longer lose to a refresh happening at the same moment. The revoke always blacklists the token the device holds now, and a refresh of a device revoked meanwhile is refused without handing out a new token.
  • A password change or ban now ends the user's pending and confirmed device sessions, and a device the user approved before their last password change can no longer collect a token.
  • The admin Reset 2FA action on a member of a privileged group requires the privileged-groups permission, like setting their password or deleting them.

Changed

  • The QR code for device sign-in now carries the short code instead of the polling token, so someone who sees the QR code can no longer collect the session. golem15.user.device_auth.auth_url gains a {short_code} placeholder and defaults to {frontend_url}/device/scan/{short_code}. POST /devices/authorize also accepts the short code in its token field.
  • The device status poll hands the session token only to the client with the User-Agent that started the flow. A flow started through a server-side proxy and polled from a browser no longer receives its token.
Subscribe via RSS