How to change password via REST when validating email address (first login link)

Question

Is there a REST api way to allow the user to set a new password on email confirmation / first time login?

I tried the same code as for changing the password when you're already logged in and adding the pass-reset-token as a GET param but without any luck. Server always returns the following message:

{"message":"Users can only update their own account, unless they have the \u0027administer users\u0027 permission."}

Does anyone have any idea? If not, I will write some custom code inspired from the core module but I hoped that the rest api should handle such things.

Answer 1

I'm not sure there is a pure Drupal core way of doing this, but there are contrib modules which can help. These modules involve resetting the password when it has been forgotten but may help with understanding the process.

Password reset REST allows resetting the password via REST.

Small module to help with resetting password through rest.

This attempts to provide the same logic present with a pass-reset-token as you'd do with the normal interface.

REST Password Request provides an alternative method which involves generating a temporary password so the user can change their password via rest, and then log in as normal.

REST Register User with Email Verification supports email validation, but may not be exactly what you're after.

It is also worth reviewing this issue regarding anonymous REST and user entities: A REST resource's "auth" configuration MUST be non-empty, which prevents configuring it for anon access only

Answer 2

To avoid all security implications I just displayed the actual Drupal form when the user changes the password for the first time, styled it to look like the js app and added a redirect on form submission to the actual js app page. Works fine so far.