RocketChat / RocketChat/Rocket.Chat

Reset Password Page stuck for OAuth-linked accounts.

Open
#36,698 10 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

planned
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:
When a user with a pre-existing, unverified local account attempts to log in via an OAuth provider (e.g., Google) using the same email address, they are correctly directed to the ResetPasswordPage. However, the "Reset" button on this page is non-functional due to a bug in the form's submission logic. The button calls the incorrect API endpoint (/v1/users.updateOwnBasicInfo), which does not finalize the account verification or log the user in. This leaves the user stuck on the password reset page in an inescapable loop.

Steps to reproduce:

  1. On a fresh Rocket.Chat server, create a new user with a standard email and password (e.g., testuser@example.com). Do not verify this user's email.

2.Log out.

  1. Configure Google OAuth for the server.

  2. On the login page, click the "Login with Google" button and authenticate with the same email address (testuser@example.com).

  3. Observe that you are correctly redirected to the /setup-wizard page to set a new password.

  4. Enter a valid new password in both fields and click the "Reset" button.

Expected behavior:
After clicking "Reset", the user's password should be updated, the requirePasswordChange flag on their account should be set to false, they should be logged in, and then redirected to the application's home page.

Actual behavior:
When the "Reset" button is clicked, a POST request is sent to the /api/v1/users.updateOwnBasicInfo endpoint. The server responds with success: true, but the requirePasswordChange flag on the user object remains true. The user is not logged in or redirected, and they remain stuck on the "Reset password" page.

Path: Rocket.Chat/apps/meteor/node_modules/@rocket.chat/web-ui-registration/src/ResetPassword/ResetPasswordPage.tsx

Image Image

Server Setup Information:
Version of Rocket.Chat Server: develop branch (local development environment), 7.10.0
Operating System: macOS
Deployment Method: Source (ran with yarn dsv)
NodeJS Version: v22.16.0
MongoDB Version: (Specify your MongoDB version, e.g., 6.x)

Client Setup Information
Desktop App or Browser Version: Brave, Chrome
Operating System: macOS

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in apps/meteor/node_modules/@rocket.chat/web-ui-registration/src/ResetPassword/ResetPasswordPage.tsx and trace the Reset form submission from the button to the current /v1/users.updateOwnBasicInfo request. Verify the flow against the reproduction steps; it is done when resetting the password clears requirePasswordChange, logs the user in, and redirects to the application home page.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, frontend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.