Forgot password
This pack adds password recovery. A user who forgets their password requests a reset link by email, then follows a secure link to a form where they set a new password.
- The request form shows the same confirmation whether or not the email is registered, so it cannot be used to discover which addresses have accounts.
- Both the reset email and the request form are throttled against abuse.
- A branded, MJML reset-password email carrying the secure link.
This pack extends the auth pack's User model and login page and reuses its transactional email setup. Apply the auth pack first.
Apply the forgot password pack with Flow. Start a new session in your selected coding agent and execute the following slash command inside it.
After applying, Flow will make the following changes to your app.
-
Land the backend as shipped, from the password-reset table and the User mixin through the validators, the controller, the reset mailer and email template, and the routes.
-
Add the request and reset screens, and a "Forgot password?" link on your login page, restyled to your design system.
-
Run the tests, then walk the request, email, and reset flow and show you the result.
Apply the forgot password pack to your app by hand by working through the steps below in order. It builds on the auth pack, adding a password-recovery flow: a request page that emails a reset link, a reset page that sets a new password, and a "Forgot password?" link on your login page.
-
Confirm your auth foundation
This pack builds on the auth pack. Make sure your app already has it before continuing.
- Your User model composes
withAuthFinder(...)andwithManagedEmail(), and@adonisplus/personais installed. - The transactional email setup is wired: the
emailLayoutcomponent and thebrandNamemail global exist, mail is configured, andappUrlis exposed fromconfig/app.ts. - A web session guard and the
guestnamed middleware are registered,formsThrottleis defined instart/limiter.ts, and your login page andsession.createroute resolve.
- Your User model composes
Flow adapts the pack to your app, so the exact set of created and edited files depends on what you already have. This is the shape of an apply onto the React starter kit with the auth pack in place.
Configuration
The reset link is minted by the withManagedPassword() mixin on the User model, the mixin this pack adds beside auth's withManagedEmail(). It creates each reset token, hashes it, and stores it in a database table. Pass an options object to the mixin to change its defaults.
expiresIn
How long a reset link stays valid, as a number of seconds or a time expression. Defaults to 1 day.
table
The table reset tokens are read from and written to. Defaults to password_reset_tokens.
tokenSecretLength
The length of the random secret behind each token. Defaults to 40.
export default class User extends compose(
UserSchema,
withAuthFinder(hash),
withManagedEmail(),
withManagedPassword({ expiresIn: '1 hour' })
) {}A request answers the same way for every email
The request action looks the user up but answers the same whether or not an account exists, so the flow cannot be used to discover which addresses are registered. The reset email is sent only when the account exists, and minting a token is throttled to one send a minute per address, so a burst of requests still delivers at most one message. The request route sits behind the formsThrottle limiter, which rate-limits the endpoint itself.
A reset link works once, then expires
Setting a new password verifies the token and updates the password in one step, then clears the account's remaining reset tokens, so any other outstanding link stops working. A link that is invalid or past its expiry is rejected and the password stays unchanged. Change how long a link stays valid with the mixin's expiresIn option above.
1.0.0
Initial release.