Closed alexskr closed 6 months ago
All modified and coverable lines are covered by tests :white_check_mark:
Comparison is base (
7580da8
) 72.17% compared to head (e78397b
) 73.06%. Report is 1 commits behind head on develop.:exclamation: Current head e78397b differs from pull request most recent head 0a2b100. Consider uploading reports for the commit 0a2b100 to get more accurate results
:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.
@alexskr - can you provide a description of how your modification changes this functionality? In other words, what happens now when an end user receives a reset password link via email? Can they only click the link once? We have a report on the support list from an end user that is getting an authorization error when they try to reset their password:
... while the credentials enable me to get a password reset email, when I click on the provided link to reset my password, I get the following error message: “Password reset not authorized with this token. Please reset your password again.” I have tried three times.
I updated the description of the PR.
It takes 50+ seconds for the password reset to go through when I try to do it in production which is a problem that should be looked into. UI also doesn't provide any feedback to users that its working on the request which can cause people to leave the page before request completes
Add password reset token expiration time to fix a security issue where reset token never expires and the same reset token can be used multiple times to reset password.
Changes:
resetTokenExpireTime
attribute to user which is set toTime.now + 1.hour
when reset password request is send.resetTokenExpireTime
is cleared out when user attempts to resets password. This means that users have only one attempt to reset password for each change password request.Addresses https://github.com/ncbo/ontologies_api/issues/60