Reauthentication on password change: Make session age condition configurable

[flokle]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

If "Secure Password Change" is enabled, gotrue is currently hardcoded to check if the active session is older than 24 hours. Only if this is the case, the supplied nonce of the updateUser function is checked for validity. The description of the option ("Users will need to be recently logged in to change their password...) in the supabase dashboard implies (at least for me) a much shorter period.

Expected behavior

I would expect a time period more in the range of a few minutes. It would be ideal if one could configure the period in the dashboard and thus also set it to 0, so that the nonce is always required.

I also only noticed this behavior by accident. As long as the 24 hours are not exceeded, a nonce supplied in updateUser is simply ignored, so that, within that period, any value is accepted.

[roachadam]

+1

[Hallidayo]

Hi everyone, due to inactivity on this issue I've moved the issue over to discussions/enhancements.