To change the password of a user account, Drupal requires the user to input their password.

I have a decoupled Drupal app using JSON:API.

The Nocurrent Pass module disables the password check when changing the email address, which is what I want, but it does so by means of hook_form_alter(), which means it doesn't remove the check for JSON:API/REST.

How can I disable this "password required" requirement to allow users to change their email address without inputting their password for JSON:API/REST (really, I want to disable it everywhere in all cases, including for JSON:API/REST)?


This decoupled app doesn't even use passwords; users log in by a code sent to their email. There is a risk of accounts getting highjacked by an attacker changing the email address, but because the app is using the Alternative User Emails module, old email addresses can still be used to log in, so it is impossible to get locked out of the account. Thus the password requirement makes no sense in this case, and I want to disable it.

  • you say Alternative User Emails makes it impossible to get locked out of account, it means you don't provide any feature so that user can control their alternative emails, cause if you do the hacker might remove original owners email from list, but the problem raise here is if a hacker inject their email address to that list it will guaranteed a life time access, isn't it? Commented Mar 5 at 19:32
  • @AlirezaTabatabaeian That's right, it's impossible for users to edit the list of alternative emails. So an admin would clean up the mess if somebody gets hacked. Anyway, this is a small site with little valuable private data so it is unlikely to be a target in the first place. Commented Mar 6 at 1:29

2 Answers 2


Create a REST endpoint for this and in the post method get the user object and set the email like below -


Do not forget to get the current email id in a separate variable and save that in the field introduced by Alternative User Emails, i.e., alternative_user_emails

Something like this -

$current_email = $user->getEmail();
$existing_email_ids = $user->alternative_user_emails->getValue();
$existing_email_ids += $current_email;

  • You do not need to update the email address for alternative_user_emails; the module does that automatically. Updating the address manually will crash Drupal because you will break the validation constraint (unique value) since you will get duplicate email addresses. Commented Mar 10 at 11:27

Since it seems this functionality doesn't exist, I decided to create the JSON-RPC Change Email No Password module. This adds a JSON-RPC endpoint for changing the email address without inputting the user's password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.