fix: Revoke DRF token after password change by bakirFS · Pull Request #8698 · Flagsmith/flagsmith

bakirFS · 2026-10-08T09:11:42Z

Thanks for submitting a PR! Please check the boxes below:

I have read the Contributing Guide.
I have added information to docs/ if required so people know about the feature.
I have filled in the "Changes" section below.
I have filled in the "How did you test this code" section below.

Changes

How did you test this code?

Logged in, changed password, verified the token was deleted in Django-admin, after logging in with the new password a new token is issued. When the user wants to change the password they get a modal warning them they will be logged out and when they are redirected to the login page a banner says they need to log back in with the new password.

vercel · 2026-10-08T09:11:48Z

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated
docs	Ignored	Preview	Nov 6, 2026 12:38pm UTC
flagsmith-frontend-preview	Ignored	Preview	Nov 6, 2026 12:38pm UTC
flagsmith-frontend-staging	Ignored	Preview	Nov 6, 2026 12:38pm UTC

github-actions · 2026-10-08T09:12:05Z

Docker builds report

Image	Build Status	Security report
`ghcr.io/flagsmith/flagsmith-e2e:pr-8698`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-api-test:pr-8698`	Finished ✅	Skipped
`ghcr.io/flagsmith/flagsmith-api:pr-8698`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith:pr-8698`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-private-cloud:pr-8698`	Finished ✅	Results ✅
`ghcr.io/flagsmith/flagsmith-frontend:pr-8698`	Finished ✅	Results ✅

coderabbitai · 2026-10-08T09:12:14Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Last reviewed commit: 04d9679
Latest commit, not reviewed: c79aa68

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The API now revokes a user’s authentication tokens when the password changes or resets. The dashboard requires confirmation before a password change. After a successful change, it logs the user out and displays a notification at the next login.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Severity of issue fixed: High

Merge Risk: Low · previous review 04d96

Password resets now revoke old tokens. Two bounded issues remain: a retry can show an outdated password error, and a failed password save can require users to sign in again with their old password. These warrant owner awareness before merging.

- [ ] Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

Recent review info

Run configuration

Source mode: Auto

Repository: Unavailable

Branch: Unavailable

File: No configuration file from this repository applied

Commit: Unavailable

Layers: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: `3b827fae-5639-4451-8fb7-f05b2cf2d746`

Commits

Reviewing files that changed from the base of the PR and between `8f87f5f` and `04d9679`.

Files selected for processing: 5

`api/app/settings/common.py`

`api/tests/unit/custom_auth/test_unit_custom_auth_views.py`

`api/tests/unit/users/test_unit_users_models.py`

`api/users/models.py`

`frontend/web/components/pages/home-page/HomePage.tsx`

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

coderabbitai

Actionable comments posted: 2

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 3e7486dc-9d8d-4e94-96ba-f5a2b256a864

📥 Commits

Reviewing files that changed from the base of the PR and between 6b0a8d1 and 903e9b9.

📒 Files selected for processing (5)

api/app/settings/common.py
api/tests/unit/custom_auth/test_unit_custom_auth_views.py
frontend/common/constants.ts
frontend/web/components/pages/AccountSettingsPage.tsx
frontend/web/components/pages/home-page/HomePage.tsx

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

codecov · 2026-10-08T09:16:42Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.90%. Comparing base (5051ac2) to head (c79aa68).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #8698    +/-   ##
========================================
  Coverage   98.90%   98.90%            
========================================
  Files        1697     1698     +1     
  Lines       71367    71491   +124     
========================================
+ Hits        70583    70707   +124     
  Misses        784      784

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-10-08T09:17:14Z

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #22920 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

2 passed

Details

2 tests across 2 suites
1 minute, 1 second
c79aa68
🔄 Run: #22920 (attempt 1)

🗂️ Previous results

✅ private-cloud · depot-ubuntu-latest-16 — run #22920 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

3 passed

Details

3 tests across 3 suites
32.9 seconds
c79aa68
🔄 Run: #22920 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #22920 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
37.2 seconds
c79aa68
🔄 Run: #22920 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22920 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
31.7 seconds
c79aa68
🔄 Run: #22920 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #22906 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

3 passed

Details

3 tests across 3 suites
35.6 seconds
150f17d
🔄 Run: #22906 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-16 — run #22906 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

4 passed

Details

4 tests across 4 suites
24.4 seconds
150f17d
🔄 Run: #22906 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #22908 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
37.3 seconds
9a37864
🔄 Run: #22908 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #22907 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
35.4 seconds
5d80f2b
🔄 Run: #22907 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #22906 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

1 passed

Details

1 test across 1 suite
34.7 seconds
150f17d
🔄 Run: #22906 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22906 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
31 seconds
150f17d
🔄 Run: #22906 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22908 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
30.7 seconds
9a37864
🔄 Run: #22908 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22907 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

1 passed

Details

1 test across 1 suite
30.7 seconds
5d80f2b
🔄 Run: #22907 (attempt 1)

github-actions · 2026-10-08T09:18:19Z

Visual Regression

24 screenshots compared. See report for details.
View full report

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 11e6a933-d532-4f74-b3f2-6e8eb7349872

📥 Commits

Reviewing files that changed from the base of the PR and between 903e9b9 and f91558b.

📒 Files selected for processing (1)

api/tests/unit/custom_auth/test_unit_custom_auth_views.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

Djoser's LOGOUT_ON_PASSWORD_CHANGE only applies to set_password, so reset_password_confirm left existing tokens valid. Delete them in FFAdminUser.set_password, which every password change goes through. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: be6c9a17-5a9f-44de-bfc1-2e7a526710d4

📥 Commits

Reviewing files that changed from the base of the PR and between f91558b and 64df31f.

📒 Files selected for processing (3)

api/tests/unit/custom_auth/test_unit_custom_auth_views.py
api/tests/unit/users/test_unit_users_models.py
api/users/models.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

for more information, see https://pre-commit.ci

Zaimwa9

The approach makes us at risk of deleting tokens on login, not just on password change (see the re-hash of outdated passwords through login). Even if it's not a daily scenario, it's hidden enough to be forgotten and that implies potential integrations disruption and logging out of other sessions

for more information, see https://pre-commit.ci

revoke drf token after password change

903e9b9

bakirFS requested review from a team as code owners October 8, 2026 09:11

bakirFS requested review from khvn26 and kyle-ssg and removed request for a team October 8, 2026 09:11

github-actions Bot added front-end Issue related to the React Front End Dashboard api Issue related to the REST API labels Oct 8, 2026

github-actions Bot added the fix label Oct 8, 2026

coderabbitai Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread api/app/settings/common.py Resolved

Comment thread frontend/web/components/pages/AccountSettingsPage.tsx Resolved

typecheck

f91558b

github-actions Bot added fix and removed fix labels Oct 8, 2026

coderabbitai Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread api/tests/unit/custom_auth/test_unit_custom_auth_views.py Resolved

vercel Bot had a problem deploying to Preview – flagsmith-frontend-staging October 12, 2026 09:23 Failure

github-actions Bot added fix and removed fix labels Oct 12, 2026

coderabbitai Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread api/users/models.py Resolved

added warning message

8f87f5f

vercel Bot deployed to Preview – flagsmith-frontend-staging October 12, 2026 09:59

View deployment

vercel Bot deployed to Preview – flagsmith-frontend-preview October 12, 2026 09:59

View deployment

github-actions Bot removed the fix label Oct 12, 2026

bakirFS and others added 2 commits October 26, 2026 11:08

Merge branch 'main' into fix/logout-on-password-change

65a61d9

[pre-commit.ci] auto fixes from pre-commit.com hooks

04d9679

for more information, see https://pre-commit.ci

github-actions Bot added fix and removed fix labels Oct 26, 2026

fixed CR comments

b2d2d93

github-actions Bot added fix and removed fix labels Oct 28, 2026

[pre-commit.ci] auto fixes from pre-commit.com hooks

a33f243

for more information, see https://pre-commit.ci

Zaimwa9 requested review from Zaimwa9 and removed request for khvn26 and kyle-ssg November 4, 2026 08:14

Zaimwa9 requested changes Nov 4, 2026

View reviewed changes

Comment thread api/users/models.py Resolved

Comment thread api/custom_auth/views.py Resolved

Comment thread api/tests/unit/users/test_unit_users_models.py Resolved

Comment thread api/app/settings/common.py Resolved

bakirFS added 2 commits November 6, 2026 10:42

addressed PR comments

e420854

Merge branch 'main' into fix/logout-on-password-change

150f17d

github-actions Bot added fix and removed fix labels Nov 6, 2026

vercel Bot deployed to Preview – flagsmith-frontend-preview November 6, 2026 10:38

View deployment

vercel Bot deployed to Preview – flagsmith-frontend-staging November 6, 2026 10:38

View deployment

chore: Update documentation artefacts

5d80f2b

flagsmith-engineering Bot requested a review from a team as a code owner November 6, 2026 10:38

flagsmith-engineering Bot requested review from talissoncosta and removed request for a team November 6, 2026 10:38

pre-commit-ci Bot and others added 2 commits November 6, 2026 10:39

[pre-commit.ci] auto fixes from pre-commit.com hooks

9a37864

for more information, see https://pre-commit.ci

remove accidentally committed ENTERPRISE_VERSION

c79aa68

github-actions Bot added fix and removed fix labels Nov 6, 2026

Zaimwa9 approved these changes Nov 6, 2026

View reviewed changes

bakirFS merged commit 773f1c0 into main Nov 6, 2026
38 checks passed

bakirFS deleted the fix/logout-on-password-change branch November 6, 2026 12:56

flagsmith-engineering Bot mentioned this pull request Nov 6, 2026

chore(main): release 2.291.0 #8891

Open

Conversation

bakirFS commented Oct 8, 2026

Changes

How did you test this code?

Uh oh!

vercel Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docker builds report

Uh oh!

coderabbitai Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Playwright Test Results (oss - depot-ubuntu-latest-16)

Details

Uh oh!

github-actions Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Visual Regression

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Zaimwa9 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

vercel Bot commented Oct 8, 2026 •

edited

Loading

github-actions Bot commented Oct 8, 2026 •

edited

Loading

coderabbitai Bot commented Oct 8, 2026 •

edited

Loading

codecov Bot commented Oct 8, 2026 •

edited

Loading

github-actions Bot commented Oct 8, 2026 •

edited

Loading

github-actions Bot commented Oct 8, 2026 •

edited

Loading