Changing security config should cancel existing "remember me" tokens

[chillu]

Acceptance Criteria

• All "remember me" tokens are expired when a password is changed or reset (retaining the current browser session)
• All "remember me" tokens are expired when a second factor is added or removed (retaining the current browser session)
• If the system is configured for multiple "remember me" tokens, they're all expired

Notes

• Excludes clearing current PHP session or other active PHP sessions for the same user (since we can't read/write session data across sessions in PHP). Unless I'm missing something here?

From Olivier:

Changing security configuration (like adding/removing 2nd factor or changing/resetting password) should result in cancelling all existing sessions. rational: users change their password because they think it might have been compromised.

[Firesphere]

Should this be in core as well?

[ScopeyNZ]

I think it probably should. I noted on Slack but this isn't necessarily a common flow. If there's the ability to log yourself out on other devices (a button labelled "log me out elsewhere" or words to that effect) then services don't always log you out of all your devices when changing your password.

Might need to have a little discussion about what suits SilverStripe best...

[robbieaverill]

@chillu are you happy for us to move this to a framework issue?

[robbieaverill]

Friendly bump @chillu

[robbieaverill]

Moved to silverstripe/silverstripe-framework#8694

[Firesphere]

I believe some work still needs to be done here. Without any extension hook or way to hook in to the reset method, the framework doesn't explicitly know the MFA has been reset, thus no reset will happen?

[robbieaverill]

Yeah assuming silverstripe/silverstripe-framework#8694 gets implemented, it'd probably have an extension hook in it somewhere. Fair enough for reopening, let's re-target this issue as "ensure MFA changes are included in resetting 'remember me' cookies assuming silverstripe/silverstripe-framework#8694 is implemented" or something to that end