Does password change issue a new api_key?

[eliotsykes]

(This question is a result of reading through these comments on the recent bootstrap-sass gem compromise: twbs/bootstrap-sass#1195 (comment))

Is the user's api_key reset when they change their password? I assumed it would be but I haven't found the code responsible. (I did find the User#reset_api_key! method, which is used by ApiKeysController#reset, but its not called when the user changes their password.)

If the api_key is not reset when the user's password changes - should it be?

[sonalkr132]

Does password change issue a new api_key?

No it doesn't reset api key. api key reset button can be found on profile edit page.

should it be?

We could give user an option to reset api key on new password page. We probably don't want to enable it by default.

[sonalkr132]

Closed by #2027