Invalidates token when user changes their password

spira · Aug 26, 2015 · 00be998 · 00be998
1 parent d901fd3
commit 00be998
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/api/app/Http/Controllers/UserController.php b/api/app/Http/Controllers/UserController.php
@@ -177,6 +177,12 @@ public function patchOne(Request $request, $id)
         // Extract the credentials and update if necessary
         $credentialUpdateDetails = $request->get('_user_credential', []);
         if (!empty($credentialUpdateDetails)) {
+            // Invalidate token for the user when user changes their password
+            if ($this->jwtAuth->user()->user_id == $model->user_id) {
+                $token = $this->jwtAuth->getTokenFromRequest();
+                $this->jwtAuth->invalidate($token);
+            }
+
             $credentials = UserCredential::findOrNew($id);
             /** @var UserCredential $credentials */
             $credentials->fill($credentialUpdateDetails);

diff --git a/api/tests/integration/UserTest.php b/api/tests/integration/UserTest.php
@@ -304,6 +304,13 @@ public function testPatchOneBySelfUserPassword()
         $this->assertResponseStatus(204);
         $this->assertResponseHasNoContent();
         $this->assertTrue(Hash::check('foobarfoobar', $updatedCredentials->password));
+
+        // Assert token is invalid
+        $jwtAuth = App::make('Tymon\JWTAuth\JWTAuth');
+        $blacklist = $jwtAuth->getBlacklist();
+        $payload = $jwtAuth->getJWTProvider()->decode($token);
+        $payload = $jwtAuth->getPayloadFactory()->setRefreshFlow(false)->make($payload);
+        $this->assertTrue($blacklist->has($payload));
     }
 
     public function testPatchOneByGuestUser()