Skip to content

Conversation

@demirmusa
Copy link
Contributor

@demirmusa demirmusa commented Aug 19, 2019

User.SecurityStamp will be changed when:

  • (AbpUserManager).ChangePasswordAsync called
  • (AbpUserManager).UpdateAsync called and if IsUserCredentialsSameWithStored returns false
    (It controls If UserName , Email and Password are changed)
    removed

resolves #4775

@demirmusa demirmusa added this to the v4.9 milestone Aug 19, 2019
@maliming
Copy link
Member

According to the source code of Identity Core, it will not update SecurityStamp in UserManager's UpdateAsync method. It will update SecurityStamp under certain methods, such as SetUserNameAsync, ChangeEmailAsync, UpdatePasswordHash.

Perhaps its idea is that developers should not use the UpdateAsync method to update important information such as passwords or usernames. For example, developers should use the UpdatePasswordHash method to modify the user's password.

Should we follow this line of thinking?

@ismcagdas
Copy link
Member

@maliming yes, we can follow this approach as well 👍 @demirmusa could you make the necessary changes ?

@demirmusa demirmusa changed the title SecurityStamp will be changed too when credentials are changed. Changes security stamp when password change via using ChangePasswordAsync function Aug 28, 2019
@ismcagdas ismcagdas merged commit aff7c50 into dev Aug 28, 2019
@demirmusa demirmusa deleted the pr/4775 branch September 4, 2019 09:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

We should change "user.SecurityStamp" whenever a users credentials have changed

3 participants