It's considered feedback and a simple recommendation from trying to manage 50+ users of various computer literacy. The suggestion is good, and will help anyone else managing many variable Cloudron Users. No need for the debate time is starting to exceed the implementation time.

@nebulon Kinda not so memorable. I can't be the only Sys Admin that gets requests day and night that you have to answer by phone and memory? Can we have a URL rewrite for /password-reset?

why not create a short URL that you'll remember?

@marcusquinn So what has been implemented is a way to reset the password on behalf of the user as an admin. If I understand you correctly, then you also want a direct link for the user to reset the password on his/her own?

That was my understanding of what @marcusquinn wanted too - for already existing logged in users to be able to reset their own passwords...

This does already exist though: https://my.example.com/login.html?passwordReset
Would that work for you?

Heh, I think that is exactly what @marcusquinn was after!

That should be added to the docs somewhere!

This does already exist though: https://my.example.com/login.html?passwordReset
Would that work for you?

Often I end up doing support over the phone or SMS without web access, so hoping this will make it easier to verbalise instructions without needing to copy/paste links.

There are two blocking issues, we need to fix first though:

1. Currently in a login session you could just change the email address right there and then trigger the password reset (this is already a bit of an issue so we will fix this anyways to require the password on email change)
2. Fix the password reset page to allow prefilling and directly jump into that form unlike now from the login page.

It is a usability issue, in that you have to first logout to trigger the email reset link.

It would also be good if it is always available on a memorable link too, like: https://my.example.com/password-reset as it's easy to then type out, in response to this question that seems to come up a couple of times a month among 60 users.

Password resets are instead verified by the email with the reset link.

I also don't think it is correct to allow password change without some kind of additional verification means otherwise if a valid access token leaks for a user, anyone with that token can change the password.

e.g. WordPress

https://wordpress.org/support/article/resetting-your-password/

Same thing on cloudron.io

When I am on the other side of this problem, as a user, what I usually do is just open a Icognito browser window and do the reset there.

User: Marcus, what's my Password?

Marcus: IDK, try resetting it at my.example.com

That's where the conversation should then end - yet it does not.

I've presented the problem and the solution, the rest's up to you