Closed
Description
If I'm not mistaken, the current flow for resetting a password is as follow:
POST /requestPasswordReset
internally generates a token and sends an email with a link to/apps/:appId/request_password_reset
GET /apps/:appId/request_password_reset
validates token and redirects to/apps/choose_password
POST /apps/:appId/request_password_reset
validates token and updates user password
From what I can tell, step #2
is not really needed. Only things I think it does is validate that the token is still valid (which is still done in step #3
) and redirects to choose_password
.
In my opinion, it would be simpler/cleaner if step #1
sent a link directly to choose_password
and skip step #2
altogether. This will in turn get rid of an extra validation and avoid a redirect altogether.
As an added bonus for those of us with custom pages, the password reset email would in turn contain a link to a "pretty" URL instead of having to go through the parse-server URL first.