GraphQL Forgot Password mutation is not working

[kevinadhiguna]

Bug report

Describe the bug

GraphQL forgotPassword mutation does not work as it always responses Bad Request even though I already set allow to forgotpassword in Users-Permissions and followed forgotPassword mutation documentation provided by Strapi in GraphQL Playground.

Steps to reproduce the behavior

1. Go to 'Settings' on the left menu
2. Click on 'Users & Permissions plugin' then select 'Roles'
3. Edit 'Authenticated' role
4. Scroll down to 'USERS-PERMISSIONS' then give a mark to 'forgotpassword' to allow it. Click Save.
5. Go to GraphQL Playground (http://localhost:1337/graphql) to test forgotPassword mutation and set email as a variable.
6. Insert email address in variable.
7. Run forgotPassword mutation.
8. See error response Bad Request but Strapi log showing /POST graphql 200.

Expected behavior

Response : { ok : true }

Screenshots

I allowed Forgot Password for authenticated users in Roles and Permissions :

Then I tested Forgot Password mutation in GraphQL Playground. I already followed GraphQL docs for forgotPassword mutation but it always responded Bad Request :

However, Strapi log shows HTTP response status 200 OK :

System

• Node.js version: v14.15.5
• Yarn version: v1.22.5
• Strapi version: v3.4.6
• Database: MongoDB
• Operating system: Ubuntu Focal 20.04 LTS

[dani832m]

I am experiencing exactly the same problem. Have you found a solution, or is the mutation simply not working right now?

[kevinadhiguna]

@dani832m Yes, I can confirm that this still happens in latest Strapi stable and NodeJS LTS version.

Application Info :

System :

• Node.js version: v14.16.0
• Yarn version: v1.22.5
• Strapi version: v3.5.3
• Database: MongoDB
• Operating system: Ubuntu Focal 20.04 LTS

Any help will be appreciated.

[dani832m]

By default Strapi provides a local email system called Sendmail, but I can see that many experience they get "Bad Request" using this provider. I switched to a third party (SendGrid), and now everything is working!

Just install a new provider, get your API key and make a few configurations in ./config/plugins.js

Doc: https://strapi.io/documentation/developer-docs/latest/development/plugins/email.html#configure-the-plugin

[derrickmehaffy]

@dani832m is correct, you need to have sendmail package installed and configured.

Marking as closed:

[derrickmehaffy]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/email-setup-on-ubuntu-auth-form-error-email-invalid/4130/4

[kevinadhiguna]

I was just reading that at the moment. What a coincidence haha. Although, I heard that sendmail needs to be configured before we are able to use it, is that true ?
Furthermore, I heard a third-party service such as sendmail or mailgun are easier to setup. What's your thought ?

[kevinadhiguna]

By default Strapi provides a local email system called Sendmail, but I can see that many experience they get "Bad Request" using this provider. I switched to a third party (SendGrid), and now everything is working!

Just install a new provider, get your API key and make a few configurations in ./config/plugins.js

Doc: https://strapi.io/documentation/developer-docs/latest/development/plugins/email.html#configure-the-plugin

Thanks for your response @dani832m . It was helpful although Sendmail asks details how we use the service and sometimes one can be suspended/banned if required information is not provided enough (even though we say it is for testing only).

[derrickmehaffy]

Largely depends @kevinadhiguna as many hosts block sending emails from servers to prevent spam. I would say that most of the providers are generally safer and easier to setup but there is obviously a cost involved.

The other option (the one I use on my own projects) is to create an actual email server using something like mailcow: https://mailcow.email/ and use the nodemailer provider. Similiar restrictions as sendmail but it has some baked in middleware to handle a lot of the required headers and such, plus it has a built in SoGo interface if you really want to go the "self-hosted" email service.

[dlujan]

I'm still facing a similar issue. Instead I get an "unauthorized" error when I try to fire the forgotPassword mutation. I have the permission checked in the strapi admin too. I'm using strapi v4.
"errors": [ { "message": "Unauthorized", "extensions": { "error": { "name": "ApplicationError", "message": "Unauthorized", "details": {} }, "code": "STRAPI_APPLICATION_ERROR" } } ], "data": { "forgotPassword": null }

[james-theretreater]

I was having a similar issue, 500 server error. Below comment solved this for me.

#13100 (comment)