Clear tokens after changing a password

[manukall]

Changing a users password should invalidate all of their tokens.

[LeeroyDing]

What about the session that's changing the user's password? Will user be kicked out after a password change?

[manukall]

i haven't started on this yet. i think it would make sense to provide the user with a new token and the existing ones after they changed their password. what do you think?

[LeeroyDing]

I think remove all tokens and return a new valid one should be good, and the client would be able to decide the behaviour (logging out all clients or keeping the current one in).

[manukall]

that sounds good to me.
did you want to work on that? 😉

[LeeroyDing]

Definitely interested! I'm new to phoenix & ecto, I'll give it a try :)