Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reduce complexity by making short-term password reset tokens use UUIDs only. #3491

Closed
4 tasks done
dessalines opened this issue Jul 5, 2023 · 0 comments
Closed
4 tasks done
Labels
area: maintenance enhancement New feature or request

Comments

@dessalines
Copy link
Member

Requirements

  • Is this a feature request? For questions or discussions use https://lemmy.ml/c/lemmy_support
  • Did you check to see if this issue already exists?
  • Is this only a feature request? Do not put multiple feature requests in one issue.
  • Is this a backend issue? Use the lemmy-ui repo for UI / frontend issues.

Is your proposal related to a problem?

Right now, password reset tokens, which used to use randomly generated UUIDs, are now being pointlessly hashed using SHA256. These tokens shouldn't live more than a day, and are only emailed to that users email directly, so hashing is pointless here.

Describe the solution you'd like.

The resets should:

  • Just use and check postgres-generated UUID columns.
  • Add a scheduled job to delete these reset rows after a day.

Describe alternatives you've considered.

N/A

Additional context

#3388

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: maintenance enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant