User password reset request responds as successful, but fails silently - TTL Issue
- Langage dominant
- Java
- Étoiles
- 3.1k
- Forks
- 1.4k
- Merge moyen
- 6 j 19 h
- PR mergées (30 j)
- 32
Description
### problem
When a user requests a password reset at the login page, with password reset emails enabled, it returns a successful message to the user and emails them a reset token.
If the user requests another reset within that token's window (user.password.reset.ttl), it will still return a successful message to the user but willl fail internally with the message:
`DEBUG [o.a.c.u.UserPasswordResetManagerImpl] Failed to reset token and send email. Password reset token is already set for user user@emaildomain.com in domain id: xy with account primary and email user@emaildomain.com`
This doesn't appear in the event log of the user either.
### versions
4.22.1.0
### The steps to reproduce the bug
1. Have settings enabled for user password reset (user.password.reset.enabled = true) and an email host configured (user.password.reset.smtp.host)
2. Request a password reset.
3. Observe the first reset email.
4. Request another password reset.
### What to do about it?
There's a few issues here I think should be addressed:
1. Consider if password reset attemps should be visible in the user's Event's page. It might create spam in the events list, so might not be a good idea.
2. Consider either:
- Allowing a user to re-request a new password reset token and reset the TTL window using the new token (my desired outcome, and what I'd expect end-users would be familiar with).
- If not the above, then wait for the email to be successfully queued/sent and return the success from that. If the email isn't sent due to the token being within the TTL, then return a user-friendly message that they cannot request a new token until a specified datetime.
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Commencez par reproduire la deuxième demande de réinitialisation du mot de passe avec user.password.reset.enabled et user.password.reset.smtp.host configurés. Lisez UserPasswordResetManagerImpl autour de l’échec consigné et suivez la manière dont la réponse de la page de connexion est produite. Done doit être un résultat défini et visible par l’utilisateur lorsqu’un token de réinitialisation est encore dans sa TTL, le comportement étant couvert par les tests pertinents de réinitialisation du mot de passe.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- java
- Domaine
- authentication, backend
- Type d'issue
- Bug
- Difficulté
- 4/5
- Temps estimé
- 3-5 jours
- Activité
- Calme
- Clarté
- À clarifier
- Accessibilité débutants
- 45/100