TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-12-23 05:26:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(login v1): update password verification handling (#11202)

Browse Source 
# Which Problems Are Solved

Failed password attempts in login V1 potentially created new session
entries.

# How the Problems Are Solved

Correct handling to only update existing sessions.

# Additional Changes

None

# Additional Context

- reported through support
- requires backport to v4.x
This commit is contained in:
Livio Spring
2025-12-17 09:23:54 +01:00
committed by GitHub
parent 5a7136fe67
commit d79bfe6eba
1 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
internal/auth/repository/eventsourcing/handler/user_session.go
View File

@@ -257,13 +257,21 @@ func (u *UserSession) Reduce(event eventstore.Event) (_ *handler.Statement, err
return handler.NewUpsertStatement(event, columns[0:3], columns), nil return handler.NewUpsertStatement(event, columns[0:3], columns), nil
case user.UserV1PasswordCheckFailedType, case user.UserV1PasswordCheckFailedType,
user.HumanPasswordCheckFailedType: user.HumanPasswordCheckFailedType:
columns, err := u.sessionColumnsActivate(event, userAgent, err := agentIDFromSession(event)
handler.NewCol(view_model.UserSessionKeyPasswordVerification, time.Time{}),
)
if err != nil { if err != nil {
return nil, err return nil, err
} }
return handler.NewUpsertStatement(event, columns[0:3], columns), nil return handler.NewUpdateStatement(event,
[]handler.Column{
handler.NewCol(view_model.UserSessionKeyPasswordVerification, time.Time{}),
handler.NewCol(view_model.UserSessionKeyChangeDate, event.CreatedAt()),
handler.NewCol(view_model.UserSessionKeySequence, event.Sequence()),
},
[]handler.Condition{
handler.NewCond(view_model.UserSessionKeyUserAgentID, userAgent),
handler.NewCond(view_model.UserSessionKeyUserID, event.Aggregate().ID),
handler.NewCond(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID),
}), nil
case user.UserV1MFAOTPCheckSucceededType, case user.UserV1MFAOTPCheckSucceededType,
user.HumanMFAOTPCheckSucceededType: user.HumanMFAOTPCheckSucceededType:
columns, err := u.sessionColumnsActivate(event, columns, err := u.sessionColumnsActivate(event,