OAuth tokens still valid after changing password

[larjona]

Hi I have changed my user password via the webUI, and checked that the old password does not work, and the new one works, in the webUI. Great.

However, I still can use the clients without doing anything. It seems it's because the OAuth token/secret didn't change; shouldn't be needed that the pump.io site revokes the oauth keys when the user changes the password? This way it would force the user to authenticate next time she uses any client too (not only in the web interface).

[tsyesika]

I'm wondering if #543 would resolve this issue as that would give you a mechanism to revoke the OAuth tokens if you felt they had been compromised?

[evanp]

Yes, we should definitely clear the OAuth tokens when your password changes, to force re-authentication.