Description
Ensure the Email provider settings require users to confirm their identity before changing their password, either by entering their current password or by completing reauthentication with a code sent to them. This stops someone with access to an open session from silently changing the password.
Rationale
If an attacker gets access to a signed-in session, for example on a shared or stolen device or through a stolen token, they could change the password and lock the real user out. Requiring the current password or a reauthentication code makes sure only the person who knows the account's credentials can change the password.
Impact
Stops session hijackers from changing passwords
Protects users from being locked out of their accounts
The application's password change form may need updating
Default Value
By default, secure password change and the current password requirement are disabled.
Pre-Requisites
Project Owner or Admin role
Application support for the current password field or the reauthenticate() call
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Verify that Secure password change or Require current password when updating is enabled.
If neither is enabled, follow the implementation steps.
Implementation Steps
Update the application's password change form to send the current password or a reauthentication code.
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Enable Require current password when updating, or enable Secure password change.
Select Save.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Disable the setting that was enabled.
Select Save.
Reference