When a user changes their password this will force all users who is logged in on the website via cookies to be forced to login again. However, there is a mobile application that logs in the user via API key. The API key also retrieves the user's data. This isn't effected by changing passwords. The user is still able to delete the API key in their settings to prevent the user from accessing any more data on the mobile application. Should changing passwords make all API keys invalidated as well?
1 Answer
I'm going with no, with the caveat that the user should be prompted to reset their API key immediately after changing their password. This is more of a UX/security balance issue than a technical one.
Usually an API token will be installed into a script somewhere, probably not accessible in the moment. Depending on what your data is on the site, it might even be so important that missing API access could cause some major issues. To top it off, the user might not even be changing their passwords due to a suspected compromise but simply standard rotation. I change my passwords regularly but I don't rotate my API keys because they don't sit on mobile devices which can be compromised far easier than my locked down server.
For all of these reasons, I don't think a mandatory key reset is reasonable. If the data is very secret (PII, money, etc) then you could get away with demanding they reset their key to finish but really with anything else I don't think it's worth the user pain.
