<div dir="ltr">+1 to all this. Feel free to make the change on the MVP page. </div><div class="gmail_extra"> <div class="gmail_quote">On Thu, Oct 26, 2017 at 8:57 AM, Jeff Ortel <<a href="mailto:jortel@redhat.com" target="_blank">jortel@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">+1 On 10/25/2017 07:04 PM, Bihan Zhang wrote: > Currently the jwt reset is accomplished through a write_only reset_jwt_secret field passed to the > //api/v3/users/{username}// endpoint. Since this field does not exist on our model it would have to be deleted > before model create/update is called, the fact that it is not is causing issue #3075 to occur. > > > On a comment in #3075 [1] I suggested creating a controller URI to mitigate this problem, but this would go > against a MVP use case of > > As an autheticated user, I can invalidate a user's JWTs in the same operation as updating the password. [done] > > I would like to propose that we remove this MVP use case since the current implementation (and I believe any > implementation that allows jwt resets to be accomplished at the //api/v3/users/{username}// URI) tunnels the > endpoint and "uses a single URI to POST to, and varying messages to express differing intents" [2] > > The user could instead make a call to update their password and another (maybe > at //api/v3/users/{username}/jwt/ ) to reset their JWT secret. > > Thoughts? > > [0] <a href="https://pulp.plan.io/issues/3075" rel="noreferrer" target="_blank">https://pulp.plan.io/issues/3075</a> > [1] <a href="https://pulp.plan.io/issues/3075#note-3" rel="noreferrer" target="_blank">https://pulp.plan.io/issues/3075#note-3</a> > [2] <a href="https://www.infoq.com/articles/rest-anti-patterns" rel="noreferrer" target="_blank">https://www.infoq.com/articles/rest-anti-patterns</a> > > <div class="HOEnZb"><div class="h5">> _______________________________________________ > Pulp-dev mailing list > <a href="mailto:Pulp-dev@redhat.com">Pulp-dev@redhat.com</a> > <a href="https://www.redhat.com/mailman/listinfo/pulp-dev" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/pulp-dev</a> > </div></div> _______________________________________________ Pulp-dev mailing list <a href="mailto:Pulp-dev@redhat.com">Pulp-dev@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/pulp-dev" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/pulp-dev</a> </blockquote></div> </div>