Replies: 1 comment 4 replies
-
|
Just to check first, did you change Other than that, it makes sense to me that only verified accounts are able to rest their password, though in that case they shouldn't be able to request a reset either. I haven't looked at what checks on account status Rodauth makes exactly. |
Beta Was this translation helpful? Give feedback.
4 replies
-
|
@janko I did! I should've copied over my My thinking is that a user could make an account, and potentially forget to verify. I know I have done that before in apps I've used. I don't see a reason why they wouldn't be able to reset their password if not verified. That action/the key is still sent to the user's email. I also would expect the request to fail upon sending to |
Beta Was this translation helpful? Give feedback.
-
|
I looked now, and Rodauth does prevent unverified accounts from requesting a password reset (code), and it also asserts that the account retrieved from the reset password token is verified (code). So, something else must be going on in your application. On failed password reset request you should be able to redirect to the page for resending account verification email: class RodauthMain < Rodauth::Rails::Auth
configure do
# ...
set_error_reason { |reason| @error_reason = reason }
end
attr_reader :error_reason
end<!-- app/views/rodauth/reset_password_request.html.erb -->
<!-- ... -->
<% if rodauth.error_reason == :unverified_account %>
<%= form_with url: rodauth.verify_account_resend_path, method: :post do |form| %>
<%= form.hidden_field rodauth.login_param, value: params[rodauth.login_param] %>
<%= form.submit "Resend verification email" %>
<% end %>
<% end %>The following self-contained example shows that Rodauth requires account to be verified on password reset request: Coderequire "rodauth"
require "sequel"
require "mail"
Mail.defaults { delivery_method :test }
DB = Sequel.sqlite
DB.create_table :accounts do
primary_key :id
Integer :status_id, null: false, default: 1
String :email, null: false
String :password_hash
end
DB.create_table :account_verification_keys do
foreign_key :id, :accounts, primary_key: true
String :key, null: false
DateTime :requested_at, null: false, default: Sequel::CURRENT_TIMESTAMP
DateTime :email_last_sent, null: false, default: Sequel::CURRENT_TIMESTAMP
end
DB.create_table :account_password_reset_keys do
foreign_key :id, :accounts, primary_key: true
String :key, null: false
DateTime :deadline, null: false
DateTime :email_last_sent, null: false, default: Sequel::CURRENT_TIMESTAMP
end
rodauth = Rodauth.lib do
enable :create_account, :verify_account, :reset_password
domain "example.com"
account_password_hash_column :password_hash
set_deadline_values? true
end
rodauth.create_account(login: "user@example.com", password: "secret123")
rodauth.reset_password_request(login: "user@example.com") |
Beta Was this translation helpful? Give feedback.
-
|
I don't know if that is actually the case with this gem. Here is what I did to recreate this: I created a very basic app, which can be cloned here that reproduces this issue. The only thing I did was modify the You can also see some Rails logs here from running it. I was able to make a |
Beta Was this translation helpful? Give feedback.
-
|
If you're using the verify_account_grace_period feature, then the account is temporarily considered verified for some time after registration. In this example application, are you also able to reset the password, or do you get the unverified response? |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
I am trying to incorporate
rodauth-railswith UUIDs, but I'm having issues with allowing users to reset passwords. For context, I have a fairly simple migration to enable UUIDs:Then I have my
rodauth-railsmigration:Everything so far is working as intended - creating accounts, verifying passwords, logging in, logging out, and closing accounts.
However, my reset password key only works for verified accounts. My repo can be found here, which just has a minimal reproduction of this issue. The issue seems to be that verified accounts will allow you to reset the password with the sent email, but then the key from the sent email for unverified accounts results in a 401. Do accounts need to be verified in order for the password to be reset? Is there a parameter that can be turned off? I didn't find anything in the Rodauth docs.
Beta Was this translation helpful? Give feedback.
All reactions