Jakub Zych a484d0e9a2 fix: reset-password and the admin password set stamp tokens_valid_after in whole seconds, so a token minted in the same second is accepted ...

JWT iat is whole seconds and every cutoff check is iat before tokens_valid_after, so a sub-second cutoff refused the login that followed a reset within the same second. POST /reset-password and the admin Users password set now truncate the cutoff to the second, like RevokeUserAccess; email_verified_at keeps full precision. Change-password and bouncer's comparison are unchanged.

2026-10-22 22:56:38 +02:00

4.3 KiB

Raw Blame History

View Raw