You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As described in #3048, adding automatic access token invalidation to 2.x is viewed as a breaking change by some of our users.
We should add a new feature flag (model-level setting?) to 2.x to control whether access token are invalidated or not. When this flag is not set, a warning should be printed to notify users about a potential security vulnerability.
In 3.0, we should throw an exception when this flag is set to false, so that users upgrading from 2.x to 3.0 are forced to upgrade their code to support our automatic token invalidation.
@timlind Is documentation update included in the above tasks? It's the first place I went to look when it broke.
Good point! What page would you recommend to change? Would you mind contributing this change yourself? In my experience, documentation contributed by users tends to be the best one, because users know best what and where they were looking for in the docs.
As described in #3048, adding automatic access token invalidation to 2.x is viewed as a breaking change by some of our users.
We should add a new feature flag (model-level setting?) to 2.x to control whether access token are invalidated or not. When this flag is not set, a warning should be printed to notify users about a potential security vulnerability.
In 3.0, we should throw an exception when this flag is set to
false
, so that users upgrading from 2.x to 3.0 are forced to upgrade their code to support our automatic token invalidation.Tasks
The text was updated successfully, but these errors were encountered: