text
fix(auth)!: reject refresh tokens issued before a password change Refresh tokens were validated only against their signature and expiry, so a token minted before a password reset stayed usable for its full thirty-day lifetime. Anyone holding a captured token kept access after the account owner rotated their credentials, which is precisely the scenario a password reset is meant to close. The user row now carries credentials_changed_at, and verifyRefreshToken compares the token's iat claim again
Conventional commit message generator
Generates a Conventional Commits message from a diff or a plain description, picking the right type and scope, using imperative mood, and flagging breaking changes correctly.
Score 0
0 comments1 results