From 26f4ba7e89358e1810764d38e2571abe063298e1 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Tue, 5 May 2026 11:56:20 +0200 Subject: [PATCH] Rewrite SECURITY_NOTES password-change entry Previous entry leaned on filler ("close the door behind it", "what people expect") and gave only a vague behavioural summary. Replace it with the actual mechanism: which table is touched, the transaction boundary, the asymmetry between change (preserves caller) and reset (revokes all), and why the session middleware needs no change. Also drop the em dash in the metadata line. Signed-off-by: Bryan Frimin --- SECURITY_NOTES.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/SECURITY_NOTES.md b/SECURITY_NOTES.md index 589ea6a37..66ac8b46c 100644 --- a/SECURITY_NOTES.md +++ b/SECURITY_NOTES.md @@ -3,16 +3,19 @@ User-facing notes on security-relevant changes to Probo. For the vulnerability reporting process, see [SECURITY.md](SECURITY.md). -## Safer Password Changes +## Password changes invalidate existing sessions -_2026-04-29 — **IAM**_ +_2026-04-29, IAM_ -> Changing or resetting a password now revokes old sessions automatically. +Password changes and resets now revoke existing sessions for the identity. -Changing a password should close the door behind it. Probo now revokes existing sessions when credentials change. +Previously, rotating a password did not touch `iam_sessions` rows: a stolen session stayed valid until its idle TTL elapsed, so a user whose account was compromised on another device could not evict that device by changing the password. -If you change your password while signed in, every other active session is expired and your current session stays open. If your password is reset, all sessions are expired. +Inside the same transaction as the password update: -It is a small security detail, but an important one. A password update now does what people expect: it cuts off old access immediately. +- A signed-in password change revokes every other active session for the identity and keeps the caller's current session. +- A forgot-password reset revokes all active sessions for the identity. The caller is anonymous (authenticated only by the reset token), so there is no current session to preserve. -Thanks to [emimoir](https://github.com/emimoir) for reporting the security issue behind this fix. +The session middleware already rejects rows with `expire_reason` set, so revoked sessions are kicked out on the next request without any middleware change. + +Reported by [emimoir](https://github.com/emimoir).