Overriding the user.reset route is unnecessary

Created on 13 July 2023, over 1 year ago
Updated 30 September 2023, about 1 year ago

Problem/Motivation

Currently, passwordless adds it's own authentication / validation steps before logging a user in on the `user.reset` route which in core Drupal is the user reset login form (which redirects users to the `user.reset.login` route).

It would be better served to allow core Drupal user controller to handle the logging in of the user from the one time login route. This allows an established route to handle the actual logging in process.

TFA module released overnight a security release implementing TFA on user reset routes it handles this by taking over the core drupal `user.reset.login` route handling and so this is incompatible with passwordless.

Steps to reproduce

Proposed resolution

1. Remove user logging in process from the PasswordlessUserController and redirect to the `user.reset.login` route to handle the logging in process

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Fixed

Version

2.0

Component

Code

Created by

🇦🇺Australia RichardGaunt Melbourne

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024