Cached credentials on password change

[ph00lt0]

Description

After changing the password the new password is not working on the webapp when logging in again in the same browser.

Ente does not clean up the old cached credentials in this scenario causing confusion to the user, who changed the password.

Version

No response

What product are you using?

Ente Photos, Ente Auth

What platform are you using?

Web - Chrome

[ph00lt0]

Not sure why this a feature request now. This is a bug in your production code.

[ua741]

When you log in via the web or desktop app, certain sensitive information is stored locally, encrypted with the password used during that particular login session. Whenever you close the tab and reopen it, users are prompted to re-enter the same password so that the local data can be decrypted.

If you change your password from a different device, the current active session will not be aware of the latest password. So, you are still required to enter the old password to decrypt the local session data.

FWIW, if you choose to log out from all other devices during the password change, the current active token on the desktop will become invalid. The app should notify you (after you enter the old password) that you have been logged out.

That said, we acknowledge that we can improve the UX and subtly notify you that you are required to enter the same password that you used during login to unlock the current session.

We will discuss this internally and figure out how we can communicate this information in a concise manner.

[ph00lt0]

I understand how it works, didn't need explanation but this certainly still is a bug. It's not about communication, that won't help. A user expects to be able to log in with their current password. The session should just be replaced in this case.

[ua741]

A user expects to be able to log in with their current password. The session should just be replaced in this case

Due to E2EE, we can't automatically replace the session. I have opened an issue to track this separately.