Skip to content

Simplify the password reset flow #1220

Closed
@andresgarza

Description

@andresgarza

If I'm not mistaken, the current flow for resetting a password is as follow:

  1. POST /requestPasswordReset
    internally generates a token and sends an email with a link to /apps/:appId/request_password_reset
  2. GET /apps/:appId/request_password_reset
    validates token and redirects to /apps/choose_password
  3. POST /apps/:appId/request_password_reset
    validates token and updates user password

From what I can tell, step #2 is not really needed. Only things I think it does is validate that the token is still valid (which is still done in step #3) and redirects to choose_password.

In my opinion, it would be simpler/cleaner if step #1 sent a link directly to choose_password and skip step #2 altogether. This will in turn get rid of an extra validation and avoid a redirect altogether.

As an added bonus for those of us with custom pages, the password reset email would in turn contain a link to a "pretty" URL instead of having to go through the parse-server URL first.

Metadata

Metadata

Assignees

No one assigned

    Labels

    type:featureNew feature or improvement of existing feature

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions