3
Password reset state should be persisted in the auth token
Source: supabase/supabase#20894 · opened by @dsl400
After clicking on the link received via email for password reset the onAuthStateChange emits two events, SIGNED_IN and PASSWORD_RECOVERY.
If the page is refreshed the PASSWORD_RECOVERY event is no longer emitted but the user is signed.
This means that the password reset link acted as a one time password.
I explored all the fields in the provided access token but I could not find any field that indicates that this token is only meant to be used for resetting the password.
If the page is refreshed the PASSWORD_RECOVERY event is no longer emitted but the user is signed.
This means that the password reset link acted as a one time password.
I explored all the fields in the provided access token but I could not find any field that indicates that this token is only meant to be used for resetting the password.
No pledges yet. Be the first to back this.
Comments
Similar requests
Handling the Password Reset for a user by Supabase itself.
2 votes · 0 comments
Handling the Password Reset for a user by Supabase itself.
7 votes · 0 comments
Password reset should not act as OTP
3 votes · 0 comments
SvelteKit Supabase auth example doesn't support password reset or user invite
3 votes · 0 comments
Verify password via API client
4 votes · 0 comments
No comments yet.