Password reset page #2151

Closed
eugenijm wants to merge 2 commits from gitlab-mr-iid-884 into develop
Member
Closes #213 Screenshots: - [Password reset form with instructions](/attachments/97470453-170d-4aab-9a92-dd97def704bb) - [User not found error](/attachments/f676ca6c-e9dc-457b-88ec-4f717f973959) - [Too many requests error](/attachments/c4bc5355-e4b5-4981-964c-a68dd8d4cb89) - [The password reset link has been sent successfully](/attachments/44a177bd-aa57-4ee1-9a86-9e0869f1607d) [Video](/attachments/b5359743-77c5-4180-976c-0c79d7b0a5bc) Complementary backend MRs https://git.pleroma.social/pleroma/pleroma/pulls/4824, https://git.pleroma.social/pleroma/pleroma/pulls/4884
Member

This seems fine.

This seems fine.
Member

Isn't it a bad practice to tell if such an email exists or not? Do we want people to be able to scan through user emails with this form/endpoint?

Isn't it a bad practice to tell if such an email exists or not? Do we want people to be able to scan through user emails with this form/endpoint?
Member

I think the error should be below the form

I think the error should be below the form
Member

I don't think "back to front page" should be a button, it should be a link, it navigates and doesn't perform any other action

I don't think "back to front page" should be a button, it should be a link, it navigates and doesn't perform any other action
Author
Member

AFAIK it's not recommended, but the reason many popular sites/apps return this error is because people tend to forget which email they used and it saves them support time down the line.

I think the security risk is partially mitigated with the help of the rate limiter which defaults to 5 attempts per 30 seconds.
The registration endpoint also returns the "email has already been taken" error, but it's similarly protected by the rate limiter and, in addition, an optional captcha.

AFAIK it's not recommended, but the reason many popular sites/apps return this error is because people tend to forget which email they used and it saves them support time down the line. I think the security risk is partially mitigated with the help of [the rate limiter](https://git.pleroma.social/pleroma/pleroma/blob/b2a8ccf37fac6e40e55ce9b224c66ef1fd655614/config/config.exs#L536) which defaults to 5 attempts per 30 seconds. The registration endpoint also returns the "email has already been taken" error, but it's similarly protected by the rate limiter and, in addition, an optional captcha.
Author
Member
Updated: - [Password reset error](/attachments/1f7160f4-6757-4109-bbb3-0f0f4a42d096) - [Return to the home page](/attachments/b1ac09d6-5e7e-4e0d-bea4-f066206b38ca)
Member

What will happen if the mailer is disabled?

What will happen if the mailer is disabled?
Member

BE should report if it's disabled or not, so that FE might hide the form entirely or show "ask your admin lol"

BE should report if it's disabled or not, so that FE might hide the form entirely or show "ask your admin lol"
Author
Member

Added this along with the BE change. password-reset-disabled

Added this along with the BE change. ![password-reset-disabled](/attachments/7fd6694b-ec13-4869-8bee-7b0c608d1af6)

Pull request closed

Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
5 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
pleroma/pleroma-fe!2151
No description provided.