nextcloud / nextcloud/server

Improve the new-user password reset page for password manager compatibility

Open
#62,555 0 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage enhancement feature: authentication
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

[!TIP]

Help move this idea forward
  • Use the 👍 reaction to show support for this feature.
  • Avoid commenting unless you have relevant information to add; unnecessary comments create noise for subscribers.
  • Subscribe to receive notifications about status changes and new comments.

Hi, I create new users with an email address (and no initial password).

The landing page is simple but misses the login / username of the new user. This can be a problem for the user but is certainly a missing information for password managers when storing the entry.

Image
<form data-v-6bdd5975="" data-v-48234338="">
    <fieldset data-v-6bdd5975="">
        <p data-v-6bdd5975="">
            <label data-v-6bdd5975="" for="password" class="infield">New password</label> <input data-v-6bdd5975="" id="password" type="password" name="password" autocomplete="new-password" autocapitalize="none" spellcheck="false" required="required" placeholder="New password">
        </p> <!----> 
        <button data-v-5ee98a45="" data-v-79b727b6="" data-v-6bdd5975="" type="submit" class="button-vue button-vue--size-normal button-vue--icon-and-text button-vue--vue-primary button-vue--wide">Reset password
    </fieldset>
</form>

Suggested change: Add an either invisible or disabled (my preferred solution) box that shows the current login. Of course this cannot be changed by the user.

I think this improvement should be quite minimal and reduces friction with end users and password managers.

Note: I would be motivated to try to make a PR myself if the change is really minimal and if I'm allowed to. Please let me know if you endorse this, I know reviewing and maintaining community-contributed PRs is also an effort on your side!

Done when: I would test the new behavior against the keepass firefox extension, a clean chrome profile and a clean firefox profile

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start from the new-user password reset page and inspect the password form shown in the issue, including how the current login is made available to the page. Verify the updated behavior with the KeePass Firefox extension, a clean Chrome profile, and a clean Firefox profile; done means password managers can identify the user's login while it cannot be changed.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, frontend
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
66/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.