After changing the storefront password, the preview link is still valid

How it was found

Description:

1. The user needs to know the storefront password to generate the preview link.
2. After the administrator changes the storefront password, users can still access the storefront through the preview link.

3.reason: （1）User can generate preview link. （2）Simply changing the password will not invalidate the preview link. Only after closing and restarting the storefront password, the previous preview link will become invalid.

Step：

1. Visit the storefront and enter the password.

2.Search shopify.theme in the web development tool of the browser to get the theme ID value. {F1482354}

3.Replace the value of the preview_theme_id parameter.

https://your-store.myshopify.com.myshopify.com/?_ab=0&_fd=0&_sc=1&preview_theme_id=xxxxxxxx

4. Access the preview link, when the storefront password is changed, the preview link is still valid.

5.Video: {F1482355}

Impact

After changing the storefront password, the preview link is still valid