Repository navigation
Server, Admin: Add password reset - #346
Merged
Merged
Conversation
lehni
added this pull request to stack #341
October 17, 2026 02:04
lehni
force-pushed
the
feature/password-reset
branch
from
October 17, 2026 03:07
474a587 to
8a7b494
Compare
- Add app.auth.passwordReset: emailed single-use links through the app's UsersController.sendPasswordReset(), with tokens stored hashed as credentials, the same answer for unknown usernames and one email a minute - End the other sessions of users whose password changes, through a hash of their hash in the session, keeping the session that changes it - Add login.passwordReset to the admin: a Forgot password? button in the login dialog, and a dialog for the new password when opened with #password-reset=, asking again after validation errors - Keep dialog buttons wider than their components off the edges, and notify the message of failed login requests
lehni
force-pushed
the
feature/password-reset
branch
from
October 17, 2026 21:24
8a7b494 to
2686098
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on #342. Users of any
UserMixinmodel can reset a forgotten password through a link sent by email, in Dito.js' admin and in other frontends through the same actions.Server:
app.auth.passwordReset: { confirmUrl, expires = '1h' }.confirmUrlis the page the email links to, with a{token}placeholder.expires.post password-resetwith{ username }always gives the same answer, whether the account exists or not, and sends at most one email a minute per user throughsendPasswordReset(ctx, user, confirmUrl), which apps override to send the email themselves.post password-reset-confirmwith{ token, password }sets the password with the model's validation and deletes the tokens. It doesn't log in.confirmUrlfor the whole app; only controllers that route the reset actions need to overridesendPasswordReset(). Sending can't change the answer, also when the method isn'tasync, and transacted actions send after the commit.Admin:
login: { passwordReset: true }adds "Forgot password?" to the login dialog. The emailed link opens the admin with#password-reset=<token>(a fragment, so the token stays out of server and proxy logs) and asks for the new password, again with the token kept if the server rejects it.Behaviour change: changing a user's password ends that user's other sessions.