[Feature Request] Implement actual forgot password rather than using magic links

[FLYEfit-Keith]

Hi guys,

I've started researching Shield over the past few days and love it. However, I have a funcamental issue with Magic Links.

My understanding of Magic Links to allow a user to login without knowing the password is a great idea. However, it doesn't work in my scenario. We use Barracuda cloud based email anti phising in front of our email server. It works by visiting every link in an email, determine if it's safe, then either deliver or quarantine. The problem with this is that once Barracuda sniffs the magic link, that link is then deleted from the database, therefore it will never work for the intended user.

My obvious workaround is to whitelist our website in Barracuda, however, that only helps users under my domain, not our customers / visitors etc. Obviously, our company is in a niche segment in that most people do not implements this soft of anti phish sniffing. It would be impractible to ask all users to implement our fix on their email system [if required].

I've searched this discussion group and all issues, open and closed. Every mention of "Forgot Password" revolves around first obtaining a magic link then processing forgotPassword.

Is there any wiggle room on the roadmap to implement an actual stand alone Forgot my Password feature when not authenticated and excluding any Magic Link functionality?

Alternatively, allow configuration of Magic Links to be used 2 times [configurable] within the [hourly] timeout. This would be a potential security issue but one I'd be welcome to live with, if I narrow the timeout to 5 or 10 minutes.

Regards
Keith

[datamweb]

Is there any wiggle room on the roadmap to implement an actual stand alone Forgot my Password feature when not authenticated and excluding any Magic Link functionality?

You can create a custom Magic Links. And then apply the desired changes.
Maybe if you can get the Barracuda IP and specify if the IP they see is equal to the value Barracuda IP then don't apply the line below.

shield/src/Controllers/MagicLinkController.php

Lines 88 to 89 in 3412fac

	// Delete any previous magic-link identities
	$identityModel->deleteIdentitiesByType($user, Session::ID_TYPE_MAGIC_LINK);

Alternatively, allow configuration of Magic Links to be used 2 times [configurable]

I'm not good with this implementation, I think checking the Barracuda IP (if it's static) is a better way.

[kenjis]

The code that deletes the magic link token is here:

shield/src/Controllers/MagicLinkController.php

Lines 159 to 160 in 3412fac

	// Delete the db entry so it cannot be used again.
	$identityModel->delete($identity->id);

[kenjis]

What is "an actual stand alone Forgot my Password feature" ?
The magic link login seems to be an actual Forgot Password feature.

[FLYEfit-Keith]

Thanks for the responses guys.

Maybe if you can get the Barracuda IP and specify if the IP they see is equal to the value Barracuda IP then don't apply the line below.

Unfortunately, if this was my only concern, I could just whitelist my website IP in Barracuda to not sniff these emails. However, other users may be on different email domains and I don't want to have to tell them to add a rule to their system. It would often be denied.

What is "an actual stand alone Forgot my Password feature" ?

I mean the traditional method where you are sent a link to actually change your password. Generally, this is not a one time use magic link so the user can click the link in their email as many times as they want within some threshold, usually time. Similar to the below examples.

https://forum.codeigniter.com/member.php?action=lostpw
https://www.kickstarter.com/login?ref=nav
https://www.koolreport.com/forgot-password

Either way, I know you guys are busy and nobody else has brought this up. So I don't want you guys implementing something for a minority.

I'm still getting to grips with Shield so at this stage. not deleting the magic link but setting a very low timeout will work for me. It just l eaves me with a small maintainability issue upgrading Shield.

[kenjis]

Thank you for explanation.

this is not a one time use magic link so the user can click the link in their email as many times as they want within some threshold, usually time.

Then, customize MagicLinkController and comment out the following:

shield/src/Controllers/MagicLinkController.php

Lines 159 to 160 in 3412fac

	// Delete the db entry so it cannot be used again.
	$identityModel->delete($identity->id);

Magic link token has expires. So you would be able to click the link as many times.