SOLVED Password Reset should be an option for logged-in users too

[marcusquinn]

Often a user will forget or get confused over passwords.

My current instructions are that they need to go to my.example.com, logout and then do a password reset.

Be better if there was a link to trigger the reset email link from already still being logged in too.

[murgero]

@marcusquinn I just have my users use bitwarden lol IDK if a password reset link while logged in is a smart idea cause that allows anyone with access to their browser to just change the password.

[girish]

You can also login in anonymous mode and get to password reset.

[marcusquinn]

@murgero Not really, they would need access to both a logged in browser and email.

[marcusquinn]

@girish Use case:

User: Marcus, what's my Password?

Marcus: IDK, try resetting it at my.example.com

That's where the conversation should then end - yet it does not.

I've presented the problem and the solution, the rest's up to you

[girish]

@marcusquinn this is only an issue because the user is already logged in, correct? I can look into what other services do.

[mehdi]

I don't know of any service that does this.

When I am on the other side of this problem, as a user, what I usually do is just open a Icognito browser window and do the reset there.

[jdaviescoates]

@mehdi I think it's fairly standard to be able to edit one's password. Normally via something called Profile / Account / Settings or similar

e.g. WordPress

https://wordpress.org/support/article/resetting-your-password/

Same thing on cloudron.io

[murgero]

@marcusquinn Oh! As an admin - why not send them a password reset link? You can do this in 2 clicks under users.

[robi]

@murgero that requires admin intervention, they should be able to do that in a self-service fashion.

[nebulon]

I am not sure what this really is about, but a user can edit his/her password through the Cloudron dashboard, but of course like with other services at least I am aware of, you have to provide the old password when setting a new one through a login session.

Password resets are instead verified by the email with the reset link.

I also don't think it is correct to allow password change without some kind of additional verification means otherwise if a valid access token leaks for a user, anyone with that token can change the password.

[jdaviescoates]

@nebulon I think the request is basically about adding an "email me a password reset link" button to the existing page where users can change their password (if they know their PW), right @marcusquinn ?

[marcusquinn]

@jdaviescoates Exactly that. There's no issue with security because it's no different to getting the link when logged out.

It is a usability issue, in that you have to first logout to trigger the email reset link.

It would also be good if it is always available on a memorable link too, like: https://my.example.com/password-reset as it's easy to then type out, in response to this question that seems to come up a couple of times a month among 60 users.

[nebulon]

@marcusquinn I see github and the likes also show a password reset link in the profile. We can do this as well, as it essentially just prefills the regular password reset form with the email address.

There are two blocking issues, we need to fix first though:

1. Currently in a login session you could just change the email address right there and then trigger the password reset (this is already a bit of an issue so we will fix this anyways to require the password on email change)
2. Fix the password reset page to allow prefilling and directly jump into that form unlike now from the login page.

[marcusquinn]

@nebulon Sounds good - be happy with that!

[nebulon]

@marcusquinn this has been implemented now and will be part of the next release.

[marcusquinn]

@nebulon Magic - thank you kindly!

Often I end up doing support over the phone or SMS without web access, so hoping this will make it easier to verbalise instructions without needing to copy/paste links.