Let's start with what the url is that you were redirected to i.e. xxx/reset/???

Also a bit of info on your configuration would help

• The URL for reset form page: http://127.0.0.1:5000/reset
• Receive email with link: http://127.0.0.1:5000/reset/LONG...TOKEN...HERE
• Arrive at URL with token: error message displayed is "Invalid reset password token".

The site has been in use for several years, but hasn't been maintained.
It uses Flask-Security, and I am attempting to upgrade using the newer Flask-Security-Too package.

I just checked and see that SECURITY_PASSWORD_HASH is set to sha512_crypt.
In reviewing the current examples, I see the argon2 appears to be recommended (or required.) I will test that next.

How is the token generated?
Maybe another package/library that needs to be updated?

A basic question - make absolutely sure you removed the old flask_security package and then install the flask-security-too package (make sure the directory in site-packages is empty).

sha512_crypt is fine - in the past few years, argon2 has received lots of enthusiastic support.

The token is generated using the itsdangerous package.

That error means that either the 'user' that is looked up with the contents of the token doesn't exist OR something wrong with the token.

I assume you have updated your database models to include the fs_uniquifier in the User model and have made sure you populated that field for any existing records.

@jwag956 , thanks for your suggestions.

I'm encountering the same issue on another site where I'm upgrade from Flask-Security to Flask-Security-Too, and went through the checklist:

• the new user field "fs_uniquifier" is added
• the old flask-security files are removed
• the User does exists
• "fs_uniquifier" IS POPULATED <--- This was the error. I filled field with random text and it works.

Glad that worked - 'random text' isn't a great idea :-) It is critical that every user have a UNIQUE fs_uniquifier.

Check out the migration tips:
https://flask-security-too.readthedocs.io/en/stable/changelog.html#id25

Yes, 'random text' is not a great idea; but in the case I was just using to troubleshoot locally.

The link to the change log is a big help. Thanks.