Skip to content

refactor: Document intentional expired-token match in password reset resend flow #10533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dblythy wants to merge 1 commit into
base: alpha
Choose a base branch
from
+6 −0
Open

refactor: Document intentional expired-token match in password reset resend flow #10533

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/Routers/UsersRouter.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -578,6 +578,12 @@ export class UsersRouter extends ClassesRouter {

// We can find the user using token
if (token) {
// Match only EXPIRED tokens (`$lt` now) on purpose. This branch powers the
// "resend password reset email" flow: when a reset link has expired, PagesRouter
// preserves the expired token on the link-expired page, and the user resends from
// it to get a fresh token + email. A still-valid token needs no resend. Do NOT
// change `$lt` to `$gt` — that breaks this flow and the
// 'can resend email using an expired reset password token' spec. (#9935)
userResults = await req.config.database.find('_User', {
_perishable_token: token,
_perishable_token_expires_at: { $lt: Parse._encode(new Date()) },
Expand Down
Loading