Problem with reset password procedure

[Former Member]

Hi,

The reset password procedure doesn’t work properly. When a user tries to reset his password, sometimes the system doesn’t send the email with the procedure to do it. The only way to unlock this situation It is one in which the customer/user cleans the browser cookies. After this procedure, the customer can do another password reset and finally receive the email

The console log file:

 [hybrisHTTP48] [10.108.10.98] [RequireHardLoginEvaluator] missing secure token in session, login required
 INFO   | jvm 1    | main    | 2018/02/10 09:54:16.573 | ^[[m
 [hybrisHTTP48] [10.108.10.98] [PasswordResetPageController] Email: ff@gmail.com does not exist in the database.

We debug the code and found the method that goes into error is: yacceleratorstorefront/web/src/com/ourgroup/storefront/controllers/pages/PasswordResetPageController.java

     @RequestMapping(value = "/request", method = RequestMethod.POST)
         public String passwordRequest(@Valid final ForgottenPwdForm form, final BindingResult bindingResult,
                 final Model model) throws CMSItemNotFoundException {
             if (bindingResult.hasErrors()) {
                 return ControllerConstants.Views.Fragments.Password.PasswordResetRequestPopup;
             } else {
                 try {
                     customerFacade.forgottenPassword(form.getEmail());
                 } catch (final UnknownIdentifierException unknownIdentifierException) {
                     LOG.warn("Email: " + form.getEmail() + " does not exist in the database.");
                 } catch (final ClassMismatchException classMismatchException) {
                     LOG.warn("Email: " + form.getEmail() + " belongs to an user who isn't a customer.");
                     return ControllerConstants.Views.Fragments.Password.ForgotPasswordErrorMessage;
                 }  
 return ControllerConstants.Views.Fragments.Password.ForgotPasswordValidationMessage;
         }
     }

The user exists and the mail it's correct. The error is not replicable in our local environment. We tried to debug the code but the method described before looks correct and doesn’t catch an exception for subscribed users. We are not able to understand which component causes an error, and which is the role of the cookies or the session in this issue.

Thanks,

Federico

[Former Member]

The reset password procedure works well but only if we delete our session data before.

[VinayKumarS · Accepted solution]

As per my understanding and analysis with latest hybris 6.0 and above.. your employee or ustomer uid and email id should be same. when you are resetting the password the email will be generated for uid. always try to maintain the uid and email id are same to fix the issue.

[Former Member · Accepted solution]

Thanks Vinay, the user mail (id) and the user uid are the same for every user. The reset password procedure works well but only if we delete our session data before.

[VinayKumarS · Accepted solution]

oh. Then before clicking the ResetPassword controller. Put @RequiresHardLogin. then if the session is expired. and user click on the reset password link. First it will ask for a login. Then user can use forget password.

[Former Member · Accepted solution]

Sounds good. But how a user can log in if he doesn't know the password? Does he only need to try to log in?

[VinayKumarS · Accepted solution]

In that case user has to click on the forget password link. so that the email will be triggered to registered email address.

[Huskar]

May sound stupid but check wether user is disabled?

[Former Member]

Thanks Krishn, the user is enable. The disable login is in false status