User registration returns Error 400 "Bad Request" when email confirmation is ON

[Elfoslav]

Bug report

Describe the bug

User registration returns Error 400 "Bad Request" when email confirmation is ON. User is created, but email is not sent.

Steps to reproduce the behavior

In Strapi Admin

1. Go to 'Settings' then "Advanced Settings"
2. Click on 'Enable Email Confirmation'
3. In bash send POST request via curl: curl -X POST -d "password=asdfasdf&email=jogin111@jqjlb.com" http://localhost:1337/auth/local/register
4. See the error: {"statusCode":400,"error":"Bad Request","message":{},"data":{}}

Expected behavior

Expected created user with given credentials and successfully sent registration e-mail.

System

• Node.js version: v15.1.0
• NPM version: 7.0.8
• Strapi version: 3.2.5
• Database: MongoDB
• Operating system: OS X 10.14.6

Additional context

Similar issue: #2425

Password reset works.

Config/plugins.js:

module.exports = ({ env }) => ({
  email: {
    provider: 'sendgrid',
    providerOptions: {
      apiKey: env('SENDGRID_API_KEY'),
    },
    settings: {
      defaultFrom: 'verified_sendgrid_email',
      defaultReplyTo: 'verified_sendgrid_email',
    },
  },
});

[derrickmehaffy]

@Elfoslav generally this error is due to the limitations in Sendgrid if you are in their testing mode (where you can only send emails to specific email addresses, IE you haven't upgraded your plan with them yet.

Can you try using the email endpoint to just send a custom email and check the response?

Also how are you setting the SENDGRID_API_KEY env variable?

[christohill]

I'm experiencing this same issue (no email provider). Creating the first user through auth/local/register works fine, but any subsequent attempts return an empty Bad Request error object {statusCode: 400, error: "Bad Request", message: {}, data: {}}. What's weird is the users are still being created, but the API response is an error.

Node.js version: v14.15.0
NPM version: 6.14.8
Strapi version: 3.2.5
Database: MongoDB
Operating system: Windows 10

[derrickmehaffy]

I'm experiencing this same issue (no email provider). Creating the first user through auth/local/register works fine, but any subsequent attempts return an empty Bad Request error object {statusCode: 400, error: "Bad Request", message: {}, data: {}}. What's weird is the users are still being created, but the API response is an error.

Node.js version: v14.15.0
NPM version: 6.14.8
Strapi version: 3.2.5
Database: MongoDB
Operating system: Windows 10

@christohill how are you testing that? With something like Postman?

[christohill]

@derrickmehaffy yep, tested in both Postman and a small @nuxtjs/strapi application with the same result.

[Elfoslav]

@Elfoslav generally this error is due to the limitations in Sendgrid if you are in their testing mode (where you can only send emails to specific email addresses, IE you haven't upgraded your plan with them yet.

Can you try using the email endpoint to just send a custom email and check the response?

Also how are you setting the SENDGRID_API_KEY env variable?

I have the same settings in Strapi admin for password reset email template and "Email address confirmation" email template. Sending password reset works, but registration and email confirmation doesn't. I set SENDGRID_API_KEY in .env file.

[Elfoslav]

I have found the BUG! Hidden one.

In node_modules/strapi-plugin-users-permissions/services/User.js sendConfirmationEmail method:

settings.message = await userPermissionService.template(settings.message, {
  URL: `${getAbsoluteServerUrl(strapi.config)}/auth/email-confirmation`,
  USER: userInfo,
  CODE: confirmationToken,
});

https://github.com/strapi/strapi/blob/master/packages/strapi-plugin-users-permissions/services/User.js#L146

This code throws ERROR: error ReferenceError: TOKEN is not defined.

Solution is to copy whole User.js to extensions/user-permissions/services/

And fix the sendConfirmationEmail method code to:

settings.message = await userPermissionService.template(settings.message, {
  URL: `${getAbsoluteServerUrl(strapi.config)}/auth/email-confirmation`,
  USER: userInfo,
  TOKEN: confirmationToken,
});

And it works like a charm!

But when I tried to confirm the e-mail, I got another error: {"statusCode":400,"error":"Bad Request","message":"token.invalid"}

So I had to change e-mail template code link from:

<a href="<%= URL %>?code=<%= TOKEN %>

to

<a href="<%= URL %>?confirmation=<%= TOKEN %>

And then it finally confirmed the user!

EDIT: Easiest solution is to change e-mail template

<a href="<%= URL %>?confirmation=<%= TOKEN %>

to

<a href="<%= URL %>?confirmation=<%= CODE %>

without modyfing User.js

I have recently updated Strapi, so maybe it was just a database issue with stored e-mail template. I don't know what are default e-mail templates for Strapi 3.2.5

If it still does not confirm your user, add confirmationToken text field in Strapi Admin to your User object.

[derrickmehaffy]

We had a security fix change in v3.2.4 that changed this logic. On a fresh v3.3.1 the template is set correctly:

related migration guide: https://strapi.io/documentation/v3.x/migration-guide/migration-guide-3.2.3-to-3.2.4.html

And if you customized the email template prior it won't be updated automatically. I'll add this to our migration guide, thanks for pointing it out.

[derrickmehaffy]

Actually after taking a 2nd look at the implementation, The shipped options were never changed (we just added the field to the user model)

Reset Password

strapi/packages/strapi-plugin-users-permissions/controllers/Auth.js

Lines 331 to 337 in bf18c2b

	settings.message = await strapi.plugins['users-permissions'].services.userspermissions.template(
	settings.message,
	{
	URL: advanced.email_reset_password,
	USER: userInfo,
	TOKEN: resetPasswordToken,
	}

strapi/packages/strapi-plugin-users-permissions/config/functions/bootstrap.js

Lines 141 to 146 in b35b8f7

	message: `<p>We heard that you lost your password. Sorry about that!</p>
	<p>But don’t worry! You can use the following link to reset your password:</p>
	<p><%= URL %>?code=<%= TOKEN %></p>
	<p>Thanks.</p>`,

Email Confirmation

strapi/packages/strapi-plugin-users-permissions/services/User.js

Lines 143 to 147 in 529d147

	settings.message = await userPermissionService.template(settings.message, {
	URL: `${getAbsoluteServerUrl(strapi.config)}/auth/email-confirmation`,
	USER: userInfo,
	CODE: confirmationToken,
	});

strapi/packages/strapi-plugin-users-permissions/config/functions/bootstrap.js

Lines 159 to 165 in b35b8f7

	message: `<p>Thank you for registering!</p>
	<p>You have to confirm your email address. Please click on the link below.</p>
	<p><%= URL %>?confirmation=<%= CODE %></p>
	<p>Thanks.</p>`,

[JonathanSchndr]

Little Hint: Sendmail ist not working at my server with email confirmation is ON - i switched to the nodemailer provider, that works great!

[strapi-bot]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/overriding-sendconfirmationemail-method-in-strapi-v4/38965/6