Open johannespn opened 1 month ago
Hello, @johannespn and thank you for opening this issue. Can you double check in the Cognito console that this user's email is unconfirmed? We'd expect that a user with no confirmed email or phone number would throw an InvalidParameterException
when trying to call the resetPassword()
API in this situation (see Cognito docs here).
Thank you for the quick answer @cwomack, I double checked that the users email is unconfirmed: see screenshot. I am not getting the exception, but the behavior I described above.
Also, I checked your codebase and the method I am calling (packages/auth/src/providers/cognito/apis/resetPassword.ts
) has this signature:
/**
* Resets a user's password.
*
* @param input - The ResetPasswordInput object.
* @returns ResetPasswordOutput
* @throws -{@link ForgotPasswordException }
* Thrown due to an invalid confirmation code or password.
* @throws -{@link AuthValidationErrorCode }
* Thrown due to an empty username.
* @throws AuthTokenConfigException - Thrown when the token provider config is invalid.
**/
So maybe it's missing the validation check for the confirmation status?
@johannespn, was this user created via either the AWS CLI or manually in the Cognito console?
@cwomack We create users via the JavaScript SDK which uses AWS CLI in the background, I believe
@cwomack any updates on this? Our customers are complaining that they cannot reset their password
Hey @johannespn :wave: how are users created with the SDK? Do the end users receive an invitation mail they use to log in for the first time?
To reset the password for an unconfirmed user that has not verified their email, you will need to use the Admin*
APIs from the SDK, specifically AdminResetUserPassword
https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminResetUserPassword.html
@josefaidt @cwomack I'm facing this issue as well and I believe it's similar to this issue: https://github.com/aws-amplify/amplify-js/issues/11270
I recently upgraded to V6 and now I can't handle this error from the frontend side because the hub doesn't send events for errors anymore. I have no way of finding out if the user who is attempting to reset their password has an unconfirmed email.
Before opening, please confirm:
JavaScript Framework
Next.js
Amplify APIs
Authentication
Amplify Version
v6
Amplify Categories
auth
Backend
None
Environment information
Describe the bug
Calling
resetPassword({ username: values.email })
fromimport { resetPassword } from 'aws-amplify/auth'
when userEmail verified = No
andConfirmation status = Unconfirmed
results inbut no email with code is being sent.
Expected behavior
I would expect this method to throw an error in the case that user
Email verified = No
andConfirmation status = Unconfirmed
Reproduction steps
see description
Code Snippet
No response
Log output
No response
aws-exports.js
No response
Manual configuration
No response
Additional configuration
No response
Mobile Device
No response
Mobile Operating System
No response
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
No response