I'm getting a strange issue using the 'Reset your password' functionality in Drupal 8.

Basically, the process works fine up to the point of clicking the Login button on the screen that shows the following message:

This is a one-time login for foobar and will expire on Tue, 20/09/2016 - 15:25.

Click on this button to log in to the site and change your password.

This login can be used only once.

When the 'Log In' button is clicked, the user is taken to a 404 page, with a url similar to:


At that point, the user is logged in, and they can go to their 'Edit profile' page and change their password, but it's not very friendly to be presented with a 404 page after being logged in.

Any ideas why this is happening?


Something is intercepting the submission to the user password reset form.

The form should post to the user.reset.login route (/user/reset/{uid}/{timestamp}/{hash}/login), handled by UserController::resetPass(), then redirect to /user/{uid}/edit?pass-reset-token={TOKEN}.

This could be a number of different things which you'll have to troubleshoot (e.g. Rules performing some redirect logic on login, an altered form submit handler, Apache redirect, a module performing some redirect logic on a subscribed event, etc.).

Given that the destination URL is essentially appending "/admin" to password reset form URL that should probably clue you in on what is causing the problem.

  • thanks @Shawn Conn - I found that there was a module implementing hook_user_login() to redirect the user to the /admin route instead of the user's profile (it's a site which only has admin level Drupal users). I've added some logic to prevent this happening when the login is the result of a password reset email. – user34185 Sep 20 '16 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy