heroku / identity

[DEPRECATED] Login and OAuth management service for Heroku
https://id.heroku.com/
MIT License
246 stars 20 forks source link

Reset password should send email in lowercase #193

Closed raul closed 8 years ago

raul commented 8 years ago

I'm not sure if this should be addressed here on in the API side, but we've recently seen two customers who use capital letters in their emails and haven't been able to reset their passwords.

I think API stores user emails in lowercase but our reset password call to API preserves the capital letters, so emails like "Some.Customer@company.com" can't be found and the "reset password" email doesn't get sent (and users can't know as we don't indicate if the email was found or not, probably for confidentiality/security reasons).

dmcinnes commented 8 years ago

Thanks! We should probably support this on the API side. I'll move the ticket there.