gitlab-org--gitlab-foss/changelogs/unreleased/security-sarcila-fix-weak-session-management.yml

---
title: Fix weak session management by clearing password reset tokens after login (username/email)
  are updated
merge_request:
author:
type: security
Add User#will_save_change_to_login? to clear reset_password_tokens Devise checks before updating any of the authentication_keys if it needs to clear the reset_password_tokens. This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/42733 (Weak authentication and session management) 2019-08-12 09:41:05 -04:00			`---`
			`title: Fix weak session management by clearing password reset tokens after login (username/email)`
			`are updated`
			`merge_request:`
			`author:`
			`type: security`