1

Is there a REST api way to allow the user to set a new password on email confirmation / first time login?

I tried the same code as for changing the password when you're already logged in and adding the pass-reset-token as a GET param but without any luck. Server always returns the following message:

{"message":"Users can only update their own account, unless they have the \u0027administer users\u0027 permission."}

Does anyone have any idea? If not, I will write some custom code inspired from the core module but I hoped that the rest api should handle such things.

  • Just to get your point, you want to the user set their new password through the REST endpoint? If so I could provide you with an example. Althought reseting password that way you should enforce security such as using SSL for connections and JWT for payload signing to avoid MiTM attacks. – d70rr3s Feb 11 at 15:31
  • I made a module for this you can use drupal.org/project/rest_password – taggartJ Feb 12 at 4:46
  • Just to avoid all that I just displayed the actual Drupal form when the user changes the password for the first time, styled it to look like the js app and added a redirect on form submission to the actual js app page – Marius Ilie Feb 12 at 10:40
2
+50

I'm not sure there is a pure Drupal core way of doing this, but there are contrib modules which can help. These modules involve resetting the password when it has been forgotten but may help with understanding the process.

Password reset REST allows resetting the password via REST.

Small module to help with resetting password through rest.

This attempts to provide the same logic present with a pass-reset-token as you'd do with the normal interface.

REST Password Request provides an alternative method which involves generating a temporary password so the user can change their password via rest, and then log in as normal.

REST Register User with Email Verification supports email validation, but may not be exactly what you're after.

It is also worth reviewing this issue regarding anonymous REST and user entities: A REST resource's "auth" configuration MUST be non-empty, which prevents configuring it for anon access only

| improve this answer | |
  • Was the suggested edit the reason for -1? – imclean Feb 12 at 23:01
0

To avoid all security implications I just displayed the actual Drupal form when the user changes the password for the first time, styled it to look like the js app and added a redirect on form submission to the actual js app page. Works fine so far.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.