Users can access the application without confirming their email when a password change is required at next login #10930

1 Answer(s)

• 

  0

  maliming created 19 days ago

  Support Team Fullstack Developer

  Hi,

  After a forced password change, the change password page signs the user in directly and skips the email confirmation check that the normal login does.

  You can use this workaround for now. Add this class to your AuthServer project:

  using System.Threading.Tasks;
  using Volo.Abp.Account.Public.Web.Pages.Account;
  using Volo.Abp.DependencyInjection;
  using Volo.Abp.Identity;
  using Volo.Abp.Security.Claims;
  
  namespace YourProjectName.Pages.Account;
  
  [Dependency(ReplaceServices = true)]
  [ExposeServices(typeof(ChangePasswordModel))]
  public class MyChangePasswordModel : ChangePasswordModel
  {
      public MyChangePasswordModel(ICurrentPrincipalAccessor currentPrincipalAccessor)
          : base(currentPrincipalAccessor)
      {
      }
  
      protected override async Task<bool> ShouldRequireForcedTwoFactorConfirmationAsync(IdentityUser user)
      {
          return !await SignInManager.CanSignInAsync(user)
              || await base.ShouldRequireForcedTwoFactorConfirmationAsync(user);
      }
  }
  

  It checks the email confirmation before the user is signed in, so a user who hasn't confirmed their email is sent to the confirmation page after changing the password.

  We'll fix this in the next patch release. Your ticket has been refunded.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel