3 ms·
Updating the 'date_password_last_changed' will invalidate all the tokens for a user. It solves the purpose but has its own trade offs.
by m4n 8y ago
Updating the 'date_password_last_changed' will invalidate all the tokens for a user. It solves the purpose but has its own trade offs.
- Alex3917 8y ago> Updating the 'date_password_last_changed' will invalidate all the tokens for a user. If someone is changing their password because it has potentially been compromised, what is a scenario where you would not want to invalidate all of their existing tokens?