Insecure send password reset mutation?

[jpmermoz]

Hi there, first of all thank you for this amazing gem.

I was looking at the SendPasswordReset mutation (https://github.com/graphql-devise/graphql_devise/blob/master/lib/graphql_devise/mutations/send_password_reset.rb), and I can see that it returns an "authenticatable" instance.

Is this a security issue? Can somebody just request something like this and get private information about the user? (Asumming he knows the e-mail)

mutation {
userSendPasswordReset(email: "john@doe.com", redirectUrl: "http://someurl.com") {
authenticatable {
email
id
firstName
lastName
...otherPrivateInfo
}
}
}

Let me know if I'm getting it right, so I can perform a pull request in order to fix this issue.
Thank you.

[00dav00]

Hey @jpmermoz, this suggestion makes a lot of sense. I was checking what devise do in this cases and it seems like return a redirect which can not be sent in gql AFAIK.

I think a sensitive value to return could be a flag indicating success if the operation finished without any exceptions being raised. WDYT @jpmermoz @mcelicalderon ?

[mcelicalderon]

Oh my, you are absolutely right @jpmermoz. I guess we need to selectively add the authenticatable field to mutations and queries @00dav00. For anyone facing this issue, what you can do until we fix it is just provide your own mutation for this operation. It can just inherit from GraphqlDevise::Mutations::SendPasswordReset and call super directly, but by doing this, the gem won't add the authenticatable field on the mutation. We will work on this one ASAP.

@00dav00 we could probably do something similar to the resendConfirmation mutation https://github.com/graphql-devise/graphql_devise/blob/49d85a1a99b9773abf4a5833b54cf34df836c9a7/lib/graphql_devise/mutations/resend_confirmation.rb and have a message returned instead of just a success Boolean

[jpmermoz]

@mcelicalderon yeah.. right now I'm just using a custom Mutation, but it would be great to just return a success message.

[00dav00]

@jpmermoz #100 should take care of this issue, please update to the latest version to get the change in your project. Thanks again for reporting this!

[jpmermoz]

@00dav00 Great! I've just updated my project and it works as expected.
Thank you so much.