fix(auth): send password reset email when user has empty password

chartgerink commented

2025-07-23 13:15:57 +00:00

Owner

We are introducing OpenID Connect integration soon in the back-end. When someone creates their account using OIDC, it leads to no password being added to the database. This needs to be handled – currently it is an empty string (non-null).

Making passwords optional in the Users table will allow us to keep that value null. If someone with a null password tries to login with a regular email+password combination, a reset password link is emailed to them. This also preempts any migration scenarios where accounts are migrated, but the password needs to be set up again.

Steps to implement for OIDC:

~~Create the migration to make password_hash nullable~~
~~Update the User model~~
Update the login handler to send password reset emails for null passwords
~~Fix the relevant OIDC handlers~~

We are introducing OpenID Connect integration soon in the back-end. When someone creates their account using OIDC, it leads to no password being added to the database. This needs to be handled – currently it is an empty string (non-null). Making passwords optional in the Users table will allow us to keep that value null. If someone with a null password tries to login with a regular email+password combination, a reset password link is emailed to them. This also preempts any migration scenarios where accounts are migrated, but the password needs to be set up again. Steps to implement for OIDC: 1. ~~Create the migration to make password_hash nullable~~ 2. ~~Update the User model~~ 3. Update the login handler to send password reset emails for null passwords 4. ~~Fix the relevant OIDC handlers~~

chartgerink commented

2025-08-11 09:02:34 +00:00

Author

Owner

Empty password after account is created using OIDC, leads to invalid credentials for any password (including empty)
Upon making password_hash nullable, the login times out for an empty password
There is also a cascade of changes in the User model required upon making the password_hash nullable, which make the code less strongly typed.
This leads me to think that it may be better to upgrade the logic in the login when the password is empty.
Setting a password for an OIDC account is a valid action - similar to migrated accounts, that would not have a password upon migration. This would mean we can keep the password_hash UNnullable, and ensure that if someone logs in and has an empty password, gets an email with a token to set the password.
This could be defaulted to only happen if there are no OIDC links present

This means steps (1) and (2) and (4) are irrelevant. The focus is to send a specific password reset email for those who are trying to log in with an empty password, and do not have OIDC links.

1. Empty password after account is created using OIDC, leads to invalid credentials for any password (including empty) 2. Upon making password_hash nullable, the login times out for an empty password 3. There is also a cascade of changes in the User model required upon making the `password_hash` nullable, which make the code less strongly typed. 4. This leads me to think that it may be better to upgrade the logic in the login when the password is empty. 5. Setting a password for an OIDC account is a valid action - similar to migrated accounts, that would not have a password upon migration. This would mean we can keep the `password_hash` UNnullable, and ensure that if someone logs in and has an empty password, gets an email with a token to set the password. 6. This could be defaulted to only happen if there are no OIDC links present This means steps (1) and (2) and (4) are irrelevant. The focus is to send a specific password reset email for those who are trying to log in with an empty password, and do not have OIDC links.

chartgerink changed title from ~~fix(auth): make password optional for OIDC first accounts~~ to fix(auth): send password reset email when user has empty password

2025-08-11 09:03:05 +00:00

chartgerink referenced this issue from a pull request that will close it,

2025-08-11 09:43:51 +00:00

fix(auth): send password reset email when user has empty password #52

chartgerink closed this issue

2025-08-11 09:44:44 +00:00

chartgerink referenced this issue from a commit

2025-08-11 09:44:44 +00:00

fix(auth): send password reset email when user has empty password (#52)

Rows
Columns

fix(auth): send password reset email when user has empty password #16