Changing default behavior on confirmation email

[dadiletta]

          The default behavior changed in 5.3 - any chance you have an older version on your dev?

Look at release notes for details

Originally posted by @jwag956 in https://github.com/Flask-Middleware/flask-security/issues/829#issuecomment-1684385695

I'd like to try again to move to 5.3 but my use case requires invite emails to log users in so they can set their initial password. I'm having trouble pulling that off. Is that possible?

[jwag956]

The referrer issue should be fixed as of 5.3.1
If I understand your use case - through some out of band mechanism a user has an account created - (they can't self-register) then you want to send an email that forces them to set a new password prior to logging in. I am not certain if something is different than whatever version of FS you are currently using?
If that's your use case - the forgot/reset password flow is the closest - though not probably the UX you are looking for.

Please add more info and lets see if we can figure out how to satisfy your use case.

[dadiletta]

Correct, my school's app requires a teacher to invite students and a student to invite their guardian. The register_user(user_form) uses a randomly generated password before sending a confirmation email. That email introduces the concept of the app to new students and parents. The user is automatically logged in when the confirmation link is taken (as of 5.2 and not in 5.3). I have an @app.before_request check to see if the user is a first-timer, in which case they are redirected to a set password page, which quietly replaces their randomly generated password (if they aren't new, it just stores their last_seen data).

May I also add that your support of this project is incredible. I greatly appreciate the time and energy you've given.

[jwag956]

Thanks - in 5.3 you can set SECURITY_AUTO_LOGIN_AFTER_CONFIRM to True to get your desired behavior.
I'll remove the deprecation warning - no real reason to not allow applications to explicitly choose what's best for them (just to be clear - auto-login after confirm or reset password goes against OWASP best-practice).

[dadiletta]

Works like a charm, thanks!