diff --git a/meet-ce/backend/src/middlewares/auth.middleware.ts b/meet-ce/backend/src/middlewares/auth.middleware.ts index ef6748ce..d34242e0 100644 --- a/meet-ce/backend/src/middlewares/auth.middleware.ts +++ b/meet-ce/backend/src/middlewares/auth.middleware.ts @@ -135,11 +135,11 @@ export const tokenAndRoleValidator = (...roles: MeetUserRole[]): AuthValidator = // Check if password change is required if (user.mustChangePassword) { - // Allow only change password endpoint when password change is required + // Allow only change-password and me endpoints const requestPath = req.path; - const allowedPath = `${INTERNAL_CONFIG.INTERNAL_API_BASE_PATH_V1}/users/change-password`; + const allowedPaths = ['/change-password', '/me']; - if (requestPath !== allowedPath) { + if (!allowedPaths.includes(requestPath)) { throw errorPasswordChangeRequired(); } }