password reset gotcha

  • i’ve been dealing with a few user pebkacs recently, & while testing the p/w reset process, i got bit by this gotcha:

    on reset, the browser asks if u want to save the new passwd, so sure…then on logging in, the browser offers my saved uid/passwds, so i click on the uid i just reset, & i’m rejected as invalid:-\

    i then realized that the uid/email was blank on the previous reset screen, so the pw was stored with a blank uid instead of the uid i’m resetting…

    latherrinserepeat: perhaps this is the source of so many login/reset issues…can the uid be added to the pw reset form to fix this?

Viewing 2 replies - 1 through 2 (of 2 total)
  • Thread Starter airdrummer

    (@airdrummer)

    nope, i c&p’d the uid field from the login page & made it hidden:
    <input name="log" id="log" value="[email protected]" class="username" type="hidden">
    but i still get “no username” in the save passwd dialog…screenshot @ https://letartliveon.com/images/savePwDialog.png

    Plugin Author Chad Butler

    (@cbutlerjr)

    That’s actually a browser issue, not a plugin issue. And more specifically, it’s a process where it’s incumbent upon the user that if they’re going to save their credentials in their browser, if doing that when resetting a password, you’d have to manually add your username. It’s not within the plugin’s purview to do that.

    Also, even if the plugin could do it, I wouldn’t go that direction. From a security standpoint, it wouldn’t be advisable to add the username to the password reset form.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘password reset gotcha’ is closed to new replies.