apache / apache/cloudstack

User password reset request responds as successful, but fails silently - TTL Issue

未关闭
#13,604 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
component:authentication
主要语言
Java
星标
3.1k
派生
1.4k
平均合并
6 天 19 小时
30 天内合并 PR
32

描述

### problem

When a user requests a password reset at the login page, with password reset emails enabled, it returns a successful message to the user and emails them a reset token.
If the user requests another reset within that token's window (user.password.reset.ttl), it will still return a successful message to the user but willl fail internally with the message:
`DEBUG [o.a.c.u.UserPasswordResetManagerImpl] Failed to reset token and send email. Password reset token is already set for user user@emaildomain.com in domain id: xy with account primary and email user@emaildomain.com`

This doesn't appear in the event log of the user either.

### versions

4.22.1.0

### The steps to reproduce the bug

1. Have settings enabled for user password reset (user.password.reset.enabled = true) and an email host configured (user.password.reset.smtp.host)
2. Request a password reset.
3. Observe the first reset email.
4. Request another password reset.

### What to do about it?

There's a few issues here I think should be addressed:
1. Consider if password reset attemps should be visible in the user's Event's page. It might create spam in the events list, so might not be a good idea.
2. Consider either:
- Allowing a user to re-request a new password reset token and reset the TTL window using the new token (my desired outcome, and what I'd expect end-users would be familiar with).
- If not the above, then wait for the email to be successfully queued/sent and return the success from that. If the email isn't sent due to the token being within the TTL, then return a user-friendly message that they cannot request a new token until a specified datetime.

贡献指南

打开贡献指南

调研方向

首先,在配置了 user.password.reset.enabled 和 user.password.reset.smtp.host 的情况下复现第二次密码重置请求。阅读记录的失败附近的 UserPasswordResetManagerImpl,并跟踪登录页面响应是如何生成的。当重置令牌仍在其 TTL 内时,Done 应该是一个已定义且对用户可见的结果,并且相关的密码重置测试应覆盖该行为。

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
authentication, backend
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
冷清
描述清晰度
需要澄清
新手友好度
45/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。