Always clear sessions when user password is updated (#3821)

* Adds repro to issue #3289 * Always clear sessions when password is updated
2017-05-16 14:13:09 -04:00
parent 9dbb89a2e4
commit 17a2d269ef
3 changed files with 23 additions and 6 deletions
--- a/src/RestWrite.js
+++ b/src/RestWrite.js
@@ -375,9 +375,12 @@ RestWrite.prototype.transformUser = function() {
      return Promise.resolve();
    }

-    if (this.query && !this.auth.isMaster) {
+    if (this.query) {
      this.storage['clearSessions'] = true;
-      this.storage['generateNewSession'] = true;
+      // Generate a new session only if the user requested
+      if (!this.auth.isMaster) {
+        this.storage['generateNewSession'] = true;
+      }
    }

    return this._validatePasswordPolicy().then(() => {