Overview
When a STAFF account is created by an OWNER, the initial password is automatically set to the last 4 digits of the user's phone number (the derived userId). Since this value is predictable, STAFF users who have not yet changed their password are at risk of unauthorized access by anyone who knows their phone number.
Goal
Detect at login time whether the STAFF user's password still matches the initial password (last 4 digits of phone), and signal the frontend to enforce a mandatory password change before allowing further access.
Suggested Approach
- Add a boolean field
isPasswordChanged (default false) to the User entity.
- Update
UserService.createUser to set isPasswordChanged = false on account creation.
- Update
UserService.changePassword to set isPasswordChanged = true on successful password change.
- Include
isPasswordChanged in LoginResponseDto (or as a claim in the JWT).
- On the frontend/API side, redirect STAFF users with
isPasswordChanged = false to a mandatory password change screen, blocking all other actions until the password is updated.
References
/cc @zlonce
Overview
When a STAFF account is created by an OWNER, the initial password is automatically set to the last 4 digits of the user's phone number (the derived
userId). Since this value is predictable, STAFF users who have not yet changed their password are at risk of unauthorized access by anyone who knows their phone number.Goal
Detect at login time whether the STAFF user's password still matches the initial password (last 4 digits of phone), and signal the frontend to enforce a mandatory password change before allowing further access.
Suggested Approach
isPasswordChanged(defaultfalse) to theUserentity.UserService.createUserto setisPasswordChanged = falseon account creation.UserService.changePasswordto setisPasswordChanged = trueon successful password change.isPasswordChangedinLoginResponseDto(or as a claim in the JWT).isPasswordChanged = falseto a mandatory password change screen, blocking all other actions until the password is updated.References
/cc @zlonce