-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
Closed
Labels
type:featureNew feature or improvement of existing featureNew feature or improvement of existing feature
Description
If I'm not mistaken, the current flow for resetting a password is as follow:
POST /requestPasswordReset
internally generates a token and sends an email with a link to/apps/:appId/request_password_resetGET /apps/:appId/request_password_reset
validates token and redirects to/apps/choose_passwordPOST /apps/:appId/request_password_reset
validates token and updates user password
From what I can tell, step #2 is not really needed. Only things I think it does is validate that the token is still valid (which is still done in step #3) and redirects to choose_password.
In my opinion, it would be simpler/cleaner if step #1 sent a link directly to choose_password and skip step #2 altogether. This will in turn get rid of an extra validation and avoid a redirect altogether.
As an added bonus for those of us with custom pages, the password reset email would in turn contain a link to a "pretty" URL instead of having to go through the parse-server URL first.
Metadata
Metadata
Assignees
Labels
type:featureNew feature or improvement of existing featureNew feature or improvement of existing feature