• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

strongloop / loopback
90%
master: 90%

Build:
Build:
LAST BUILD BRANCH: chore/update-lts
DEFAULT BRANCH: master
Repo Added 31 Jan 2017 11:54AM UTC
Files 36
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH feature/set-password-with-token
branch: feature/set-password-with-token
CHANGE BRANCH
x
Reset
  • feature/set-password-with-token
  • 2.x
  • 2.x-backport
  • 2.x-eol
  • 2.x-latest
  • 3.x-latest
  • 3.x/update-dependencies
  • acl-apidoc-fix
  • add-codeowner
  • add-node-10
  • add-validate-updateAll
  • backport/babel-es6-to-es5
  • backport/do-not-allow-duplicate-role-names
  • bajtos-patch-1
  • catch-err
  • change-status
  • chore/add-node-12
  • chore/improve-issue-templates
  • chore/update-juggler
  • copyright
  • copyrights
  • create-issue-pr-templates
  • declarative-nest-remoting
  • disable-context-tests
  • drop-node-4x
  • drop/node-0x
  • empty-password-lb3
  • empty_password
  • eol
  • feat/maintenance-lts
  • feature/access-scopes
  • feature/access-token-scopes
  • feature/change-password-api
  • feature/detectUserConfig
  • feature/enable-email-verification-replay
  • feature/object-storage
  • feature/refactor-access-token-id
  • feature/remove-model
  • fix-acl
  • fix-comma-dangle
  • fix-crash-when-replacing-unknown-user
  • fix-create-id
  • fix-dep
  • fix-lint
  • fix-npm-audit
  • fix-translation
  • fix/build
  • fix/build-2x
  • fix/change-password-multiple-users
  • fix/change-password-validation
  • fix/ci
  • fix/crash-in-verifyUserRelations
  • fix/dangling-promise-in-test
  • fix/debug-statements
  • fix/diff-remoting
  • fix/eslint-issues
  • fix/get-access-context-user
  • fix/multi-user-reset-password
  • fix/options-in-token-invalidations
  • fix/options-in-token-invalidations-master
  • fix/principal-type-polymorphic-user
  • fix/role-acl-with-multiple-users
  • fix/setRemote-updateAll
  • fix/travis-config
  • fix/unauthorized-current-user-literal-2x
  • fix/windows-ci
  • fixFilterDef
  • fix_type
  • ignore-failing-downstream-builds
  • improve/github-templates
  • juggler-version
  • license
  • lts
  • maintenance/passing-context-options-in-user.verify
  • master
  • nestRemoting/prevent-endless-relation-recursion
  • npm-test
  • persisted-model/fix-updateonly-props-check
  • production
  • remove/lehni
  • revert-3541-add-validate-updateAll
  • set-default-remote-options
  • speed-up-acl-tests
  • string-username-email
  • test-branch
  • test-ci
  • test-readme
  • translate
  • travis
  • update-dependencies
  • update-dev-deps
  • update-eslint-config
  • update-juggler
  • update-juggler-2
  • update-karma-nyc
  • update-lts
  • update-msg
  • update-strong-error-handler
  • update-strong-globalize
  • update/travis-platforms
  • updateonly_feature
  • upgrade-nodemailer
  • v2.38.2
  • v2.38.3
  • v2.39.0
  • v2.39.1
  • v2.39.2
  • v2.41.1
  • v2.41.2
  • v2.42.0
  • v3.10.0
  • v3.10.1
  • v3.11.0
  • v3.11.1
  • v3.12.0
  • v3.13.0
  • v3.14.0
  • v3.15.0
  • v3.16.0
  • v3.16.1
  • v3.16.2
  • v3.17.0
  • v3.17.1
  • v3.18.0
  • v3.18.1
  • v3.18.2
  • v3.18.3
  • v3.19.0
  • v3.19.1
  • v3.19.2
  • v3.19.3
  • v3.20.0
  • v3.21.0
  • v3.22.0
  • v3.22.1
  • v3.22.2
  • v3.22.3
  • v3.23.0
  • v3.23.1
  • v3.23.2
  • v3.24.0
  • v3.24.1
  • v3.24.2
  • v3.25.0
  • v3.25.1
  • v3.26.0
  • v3.27.0
  • v3.28.0
  • v3.5.0
  • v3.6.0
  • v3.7.0
  • v3.8.0
  • v3.9.0
  • welcome-lehni
  • welcome-nitro404
  • welcome-zbarbuto

pending completion
5720

push

travis-ci

bajtos
Implement more secure password flow

Improve the flow for setting/changing/resetting User password to make
it more secure.

 1. Modify `User.resetPassword` to create a token scoped to allow
    invocation of a single remote method: `User.setPassword`.

 2. Scope the method `User.setPassword` so that regular tokens created
    by `User.login` are not allowed to execute it.

For backwards compatibility, this new mode (flow) is enabled only
when User model setting `restrictResetPasswordTokenScope` is set to
`true`.

 3. Changing the password via `User.prototype.patchAttributes`
    (and similar DAO methods) is no longer allowed. Applications
    must call `User.changePassword` and ask the user to provide
    the current (old) password.

For backwards compatibility, this new mode (flow) is enabled only
when User model setting `rejectPasswordChangesViaPatchOrReplace` is set
to `true`.

1753 of 2204 branches covered (79.54%)

33 of 33 new or added lines in 1 file covered. (100.0%)

3208 of 3579 relevant lines covered (89.63%)

6271.05 hits per line

Relevant lines Covered
Build:
Build:
3579 RELEVANT LINES 3208 COVERED LINES
6271.05 HITS PER LINE
Source Files on feature/set-password-with-token
  • List 0
  • Changed 2
  • Source Changed 0
  • Coverage Changed 2
Coverage ∆ File Lines Relevant Covered Missed Hits/Line Branch Hits Branch Misses

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
5720 feature/set-password-with-token Implement more secure password flow Improve the flow for setting/changing/resetting User password to make it more secure. 1. Modify `User.resetPassword` to create a token scoped to allow invocation of a single remote method: `User.setPasswo... push 20 Apr 2017 08:29AM UTC bajtos travis-ci pending completion  
5718 feature/set-password-with-token Implement more secure password flow Improve the flow for setting/changing/resetting User password to make it more secure. 1. Modify `User.resetPassword` to create a token scoped to allow invocation of a single remote method: `User.setPasswo... push 20 Apr 2017 08:23AM UTC bajtos travis-ci pending completion  
5716 feature/set-password-with-token Address Simon's review push 20 Apr 2017 08:17AM UTC bajtos travis-ci pending completion  
5714 feature/set-password-with-token Split legacyPasswordFlow into two flags - restrictResetPasswordTokenScope - rejectPasswordChangesViaPatchOrReplace push 19 Apr 2017 01:42PM UTC bajtos travis-ci pending completion  
5712 feature/set-password-with-token Improve jsdoc comments push 19 Apr 2017 11:27AM UTC bajtos travis-ci pending completion  
5711 feature/set-password-with-token fix typo in code comment push 19 Apr 2017 06:40AM UTC bajtos travis-ci pending completion  
5708 feature/set-password-with-token Address more review comments push 18 Apr 2017 11:06AM UTC bajtos travis-ci pending completion  
5692 feature/set-password-with-token Simplify user.createAccessToken signature push 13 Apr 2017 02:13PM UTC bajtos travis-ci pending completion  
5682 feature/set-password-with-token fixup! da2ce0f Address code review comments push 11 Apr 2017 03:28PM UTC bajtos travis-ci pending completion  
5680 feature/set-password-with-token fixup! da2ce0f Address code review comments push 11 Apr 2017 03:20PM UTC bajtos travis-ci pending completion  
See All Builds (1043)
  • Repo on GitHub
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2025 Coveralls, Inc