Forgot Password

[tomaspalma]

Checklist of what still needs to be done

• Create rate limiter throttle just for password validation
• Handle parameters in controller because it reduces the complexity of code in the frontend

I've followed the OWASP guidelines.

As per the guidelines, there is no warning shown to the user resetting the password whether the requested email exists or not. However, we internally will not send an email if that email does not belong to any account.

1. Sends an email with the url which contains the email of the user and a signature from the server.
2. When the user clicks, it is redirected to a page where they can input their new password.

[tomaspalma]

I already applied your requested changes and I noticed now that I had forgotten to push the two commits where I changed the rate limiter and started getting the parameters of the the change password form in the backend instead of the frontend

[AvilaAndre]

@tomaspalma

I know this is not the pr that deals with the register, but does your app stop when you register a new account?
I'm trying the pr locally.

[tomaspalma]

I know this is not the pr that deals with the register, but does your app stop when you register a new account?
I'm trying the pr locally.

Do you have a local instance of mailpit running? You can do that by executing docker compose up in the root enei folder.

From what I've tried, having an instance of mailpit does not block after register but if I do not have it, it blocks because there is no connection to the smpt server the website is exepecting to have

[AvilaAndre]

I know this is not the pr that deals with the register, but does your app stop when you register a new account?
I'm trying the pr locally.

Do you have a local instance of mailpit running? You can do that by executing docker compose up in the root enei folder.

From what I've tried, having an instance of mailpit does not block after register but if I do not have it, it blocks because there is no connection to the smpt server the website is exepecting to have

Oops... That was it, thank you!

[AvilaAndre]

My observations are some nice to have changes and some discussions, changing them is not necessary. If you either change them or not is up to you.

Awesome work! :)