Forgot password REST services_token

Question

I have picked up some work on a headless Drupal 7 site, using services, and service_token.

Where the "normal" service login, as I understand it, uses a cookie to authenticate, Services Token allows authentication by passing a token as the username in a basic auth header.

All appears to work well. But I have been asked to implement "Forgot password", and I am struggling to understand how that flow fits with Services Token.

Any guidance most appreciated.

Answer 1

In Drupal 8 you can reset it by

curl  POST 'http://YOUR_SITE.URL/user/password?_format=json' \
--header 'Content-Type: application/json' \
--header 'Content-Type: application/json' \
--data-raw '{
    "mail": "USER_EMAIL"
}'

Answer 2

It's already built into the Services module, just enable its corresponding resource then do a POST ?q=[my-endpoint]/user/request_new_password.json and send along a name, e.g.: name=john or an e-mail address: [email protected]

Answer 3

The solutions, a custom endpoint that takes the token as a password.

The problem we had was that the standard services authentication flow relies on cookies and that is a problem/pain when working with AngularJS (apparently).

Hence the use of service_token. An update to the two modules allowed for most of the login and forgot password flow. service_token for auth, and services for forgot password.

To handle the reset (noting that this was not a production site and this was not the most robust of solutions), we added a custom endpoint that took the service_token token as the "current password"

Hope that is of help to others.