Forgot Password Function

A user who forgot the password sets a new one through a link sent by e-mail. Exponential 6 has this built in, on the public site and in the administration. The extension ezmbpaex brings a page of its own for sites that use password expiry. This page describes both.

The built-in page

In the administration the sign-in page links to Forgot your password?. On the public site the page is called Forgotten your password?, at the address /user/forgotpassword; where the design links to it from the login page depends on the site.

1. Enter the e-mail address of the account and send the form (Send me a link on the site, Generate new password in the administration).
2. The page answers the same whether or not an account has that address, so nobody can use it to find out who has an account.
3. The e-mail holds a link that works once, for one hour with the shipped settings (site.ini [UserSettings] ForgotPasswordKeyLifetime, in seconds). A link opened too late says This link has expired.
4. On the site, the link leads to setting a new password. In the administration, opening it generates a new password, which a second e-mail brings: sign in with it and change it to one of your own at once.

It works only for an account with a real e-mail address, on a site that can send e-mail. Otherwise an administrator sets a new password in the user's edit form, best with Change password at next sign-in ticked. On a public demonstration site no mail is sent for administrator accounts.

The page of ezmbpaex

When ezmbpaex is active, its view userpaex/forgotpassword does the same for sites with password expiry:

• The user enters the e-mail address of the account. The page answers the same whether or not an account has that address.
• The mail holds a link to a form where the user chooses the new password, and says until when the link is valid. After the new password is set, the link is used up.
• The link is valid for ForgotPasswordHashLifeTime seconds, set in mbpaex.ini; one day (86400) as shipped.
• Only the latest link works: asking again makes the earlier link invalid.
• The key in the link carries 128 random bits, so it cannot be guessed. Links issued before an update keep working until they expire.
• Each request, and each failed one, is written to the extension's audit log files.

What can go wrong

• No mail arrives. Check the spam folder and the address. If the account has no valid address, an administrator must set the password.
• "This link has expired." Ask for a new link. Only the newest link works.
• The new password is refused. It must meet the site's password rules; see Password rules and expiry.

Read more

• Logging into the admin, section Forgot your password?
• Changing the administrator password
• ezmbpaex: password expiry and validation