LG-13054: Remove automatic account creation for forgot password missing user#10434
Merged
LG-13054: Remove automatic account creation for forgot password missing user#10434
Conversation
changelog: Bug Fixes, Forgot Password, Preserve service provider metadata through password reset unrecognized email
mitchellhenke
approved these changes
Apr 15, 2024
aduth
commented
Apr 15, 2024
Comment on lines
+6
to
+9
| # You MUST deliver these messages using `deliver_now`. Anonymous messages rely on a plaintext email | ||
| # address, which is personally-identifiable information (PII). All method arguments are stored in | ||
| # the database when the email is being sent asynchronusly by ActiveJob and we must not put PII in | ||
| # the database in plaintext. |
Contributor
Author
There was a problem hiding this comment.
I'm currently writing up a one-pager proposal for how we might address this moving forward, so I'm hoping this is a temporary limitation.
To ensure all mail methods have corresponding preview methods, and that they don't raise an error when rendered See: #10434 (comment)
This was referenced Apr 15, 2024
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎫 Ticket
LG-13054
🛠 Summary of changes
Updates forgotten password flow to avoid creating a stub account when submitting an email that is not associated with a user, to prevent waste in the likely scenario that someone may not complete the process to create an account. Instead, links directly to the standard "Create an account" screen.
In doing so, this also addresses a few additional issues:
request_idof the service provider if a user were to click the "Try a different email address" primary link in the email, and therefore they would likely not arrive back at the service provider as intended📜 Testing Plan
Verify that forgotten password for missing account directs new account creation to "Create an account" page:
Verify that
request_idis retained in "Try a different email address" link:?request_id=parameter in URL👀 Screenshots