1

I have a app with multiple frontends. (Web/Android/iOS).

If you do a password reset/change at one of the frontends, should it log you out of other places?

I don't want to make things hard for users, but a user may be doing a reset/change as their password may be compromised, and so expecting that changing it from one place logs you out of others.

4

I would expect that changing my password means every touchpoint for that data needs to re-authorize, so yes, I would reset the credentials for any instance of a connection.

Usecase:

  1. User's phone is stolen and they never installed a lock screen password.
  2. Whomever has the phone now has access to all of their app information.
  3. User, trying to shut down that access, changes passwords on all of their accounts from a desktop machine as they don't have a replacement phone yet.
  4. Thief now tries to use app, is asked for authorization before they can do anything.
  • Could you add references that this is desired/expected behaviour? – shabda Oct 27 '13 at 7:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.