Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update frontend for new password reset flow #4079

Open
aapeliv opened this issue Apr 18, 2024 · 1 comment · May be fixed by #4327
Open

Update frontend for new password reset flow #4079

aapeliv opened this issue Apr 18, 2024 · 1 comment · May be fixed by #4327
Assignees
Labels
priority: high High priority issue web

Comments

@aapeliv
Copy link
Member

aapeliv commented Apr 18, 2024

In #4076, I introduce a new API call for resetting the password in a better way. The frontend should be updated to make use of this new functionality.

Background

  • Initially we had email tokens instead of passwords: you could sign up without ever setting a password, and every time you logged in, it would just send you a token by email
  • We have a "jail" system, where a user gets locked out unless they fix up something in their profile/account. We've used this e.g. for when we update ToS or similar where users have to accept before they can continue using it.

The current password reset works like this:

  1. You click "reset password", web calls ResetPassword
  2. Backend sends the right email a link to reset password
  3. User clicks on link, takes you to the web app which calls CompletePasswordReset with nothing but the token
  4. The backend clears the users' password
  5. The user goes to log in again, this time it falls back to password-less login.
  6. We email the user a login link
  7. User clicks on link and logs in
  8. User gets jailed
  9. User has to reset password through Jail/SetPassword.
  10. User finally gets in

Now with the new system we reduce it to 3 steps:

  1. You click "reset password", web calls ResetPassword
  2. Backend sends the right email a link to reset password
  3. User clicks on link, takes you to the web app which calls CompletePasswordResetV2 with the reset token and a new password
  4. Backend sets the user's password, and logs the user in
@aapeliv aapeliv added the web label Apr 20, 2024
@aapeliv aapeliv transferred this issue from Couchers-org/web-frontend Apr 20, 2024
@aapeliv aapeliv added the priority: high High priority issue label Apr 20, 2024
@aapeliv
Copy link
Member Author

aapeliv commented May 10, 2024

@bakeiro

@bakeiro bakeiro self-assigned this May 10, 2024
@bakeiro bakeiro linked a pull request May 21, 2024 that will close this issue
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
priority: high High priority issue web
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants