apollo-universal-starter-kit
apollo-universal-starter-kit copied to clipboard
Invalidate server side cookie and JWT refresh token if user changes password
Server side cookie and/or JWT refresh token should become invalid when user changes password, all frontend's should react adequately in this situation and show the user that he was logged out of current session and need to login again.
In the session where invalidation happened user should not be forced to re login. For example if user changes his password in web front end and he has mobile front-end running, then in web front-end the user should not re login, but in mobile front-end he should be showed the screen that he was logged out from current session and need to login again.
Per the second paragraph above, I wonder what would be a good way to verify user's mobile session (in case of the session auth) status and redirect him/her to the login screen? How would this implementation look like? Do we need somehow to verify the session status on each interaction with the server?