Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge password reset fix into production #387

Merged
merged 10 commits into from
Oct 31, 2024

Conversation

haoyangw
Copy link
Contributor

Same changes as #386, but rebased on top of production so that only the password reset related fixes are merged, other changes in main are kept in #377

-Move /api/password-reset backend endpoint from authenticated router to unauthenticated router
-This fixes password reset at last
-Previously, trying to reset password throws HTTP Unauthorized error, but we can't expect user to be logged in (authenticated) when they forgot their password)
-Mark all existing password reset codes for the given user as used
-This prevents user from using old codes to reset password(potential security issue maybe?)
-Return a distinct HTTP response code to frontend when given password reset code has already been used
-This prevents a potential security issue when someone tries to reuse an existing password reset code
-Distinguish between different HTTP response codes returned from backend after sending password reset request
-Display descriptive error messages that match each known response code that backend would return
-Also provide a generic but user-friendly error message when an unknown HTTP response code for an error is returned from backend
-Align the CircleAlert icon vertically in the Alert component on the password reset page when error message is to be displayed
-Vertically align the CircleAlert icon in the center of the Alert component
-Fix the link that 'Reset password' clickable components on the frontend redirect to
-Now user is finally directed to the reset password page instead of a 404 Not Found page
-Make login errors slightly more distinguishable by returning distinct error codes in the HTTP response body depending on what issue ocurred while trying to verify the given username and password
@haoyangw haoyangw changed the base branch from main to production October 31, 2024 19:06
@haoyangw haoyangw merged commit edf69c9 into production Oct 31, 2024
2 checks passed
@haoyangw haoyangw deleted the haoyang/merge-password-reset-into-prod branch October 31, 2024 19:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant