Framework: Out-of-Box ResetPassword link incorrectly formatted?

[slakbal]

• Laravel Version: 5.5.14
• PHP Version: 7.1
• Database Driver & Version: MySQL 5.7

Description:

In a fresh installation of Laravel:

Auth:routes() produces the following url for the GET password reset form by Token

Copied from line 1121 in the follwoing class: Illuminate\Routing\Router
$this->get('password/reset/{token}', 'Auth\ResetPasswordController@showResetForm')->name('password.reset');

Note how the token is part of the path: password/reset/{token}

However, the reset password link that gets generated in the out-of-the-box notification is using query parameter instead of url parameter:

Copied from line 49 in the following class: Illuminate\Auth\Notifications\ResetPassword
->action('Reset Password', url(config('app.url').route('password.reset', $this->token, false)))

This produces a link with the following format where the token is a query string parameter and not in the path. This link creates an error when clicked:

http://localhost/password/reset?THE-TOKEN

The expected format should be according to the defined route, correct? Which should look similar to:

http://localhost/password/reset/THE-TOKEN

Steps To Reproduce:

Generate a password reset notification and see the format of the generated link. It will create an error when clicked because it doesn't map to the similar structure as per the route definition.

Hope this helps!

Not sure if this is a related issue: https://github.com/laravel/framework/issues/21227

[bbashy]

Works for me on latest version 5.5.14.

$ artisan tinker
Psy Shell v0.8.11 (PHP 7.1.10 — cli) by Justin Hileman
>>> url(config('app.url').route('password.reset', 'tokentokentokentoken', false));
=> "https://projectname.dev/password/reset/tokentokentokentoken"
>>>

[slakbal]

So weird!!

Copy and pasted the everything from you above and getting the following:

`
λ php artisan tinker
Psy Shell v0.8.11 (PHP 7.1.7 — cli) by Justin Hileman
=>>> url(config('app.url').route('password.reset', 'tokentokentokentoken', false));
=> "http://localhost/auth/password/reset?tokentokentokentoken"

`

I will research it further and give feedback if I can see what is going on. Thanks for your feedback in the meantime.

[bbashy]

Have a look at your route:list command to see if it's got the {token} param.

$ rl | grep password.reset
|        | GET|HEAD  | password/reset                                             | password.request                        | App\Http\Controllers\Auth\ForgotPasswordController@showLinkRequestForm         | web,guest                                                    |
|        | POST      | password/reset                                             |                                         | App\Http\Controllers\Auth\ResetPasswordController@reset                        | web,guest                                                    |
|        | GET|HEAD  | password/reset/{token}                                     | password.reset                          | App\Http\Controllers\Auth\ResetPasswordController@showResetForm                | web,guest                                                    |

[slakbal]

Ok I've found the issue. I only work with named routes.

I have the following in my routes file, same name but distinguished by GET and POST verbs:

    Route::get('reset/{token}', 'Auth\ResetPasswordController@showResetForm')->name('password.reset');
    Route::post('reset', 'Auth\ResetPasswordController@reset')->name('password.reset');

I expected it to pick the correct route based on the GET or POST verb. Not sure if this is supported? :)

So it then generates the following url when I tinker

λ php artisan tinker
Psy Shell v0.8.11 (PHP 7.1.7 — cli) by Justin Hileman
>>> url(config('app.url').route('password.reset', 'tokentokentokentoken', false));
=> "http://localhost/auth/password/reset?tokentokentokentoken"

But when I remove the ->name('password.reset') from the POST route it generates the correct URL.

    Route::get('reset/{token}', 'Auth\ResetPasswordController@showResetForm')->name('password.reset');
    Route::post('reset', 'Auth\ResetPasswordController@reset');

Which then produces:

λ php artisan tinker
Psy Shell v0.8.11 (PHP 7.1.7 — cli) by Justin Hileman
>>> url(config('app.url').route('password.reset', 'tokentokentokentoken', false));
=> "http://localhost/auth/password/reset/tokentokentokentoken"

I will just give them explicit different names for now. Or do you know if the framework is suppose to pick routes based on the VERB even if they have the same name?

Sorry, I hope I didn't waste too much of your time!!

[36864]

The route() helper has no knowledge of http methods/verbs.
Route names must be unique.

[badrshs]

I have the same issue , I didnt understand what is the problem also my output same as what is written above , but i couldn't solve the problem

[badrshs]

 Route::get($backend.'/password/email', 'Auth\ForgotPasswordController@showLinkRequestForm')->name('password.email');
Route::post($backend.'/password/email', 'Auth\ForgotPasswordController@sendResetLinkEmail');

// Password reset routes...
Route::get($backend.'/password/reset/{token?}', 'Auth\ResetPasswordController@showResetForm')->name('password.request');
Route::post($backend.'/password/reset', 'Auth\ResetPasswordController@reset')->name('password.reset');

|        | POST      | backend/cpanel/password/email                   |                     | App\Http\Controllers\Auth\ForgotPasswordController@sendResetLinkEmail  | web,guest     |
|        | GET|HEAD  | backend/cpanel/password/email                   | password.email      | App\Http\Controllers\Auth\ForgotPasswordController@showLinkRequestForm | web,guest     |
|        | POST      | backend/cpanel/password/reset                   | password.reset      | App\Http\Controllers\Auth\ResetPasswordController@reset                | web,guest     |
|        | GET|HEAD  | backend/cpanel/password/reset/{token?}          | password.request    | App\Http\Controllers\Auth\ResetPasswordController@showResetForm        | web,guest     |
|

laravel version 5.5.34
any idea please ?

[bbashy]

@badrshs And what is returned from tinker?

[badrshs]

"http://localhost/auth/password/reset?tokentokentokentoken"

[badrshs]

i have solved the problem , but I dont know the reason of getting those things .
what I did is changing the place of the name to other route like this

Route::get('/password/email', 'Auth\ForgotPasswordController@showLinkRequestForm');
Route::post('/password/email', 'Auth\ForgotPasswordController@sendResetLinkEmail')->name('password.email');

Route::get('/password/reset/{token?}', 'Auth\ResetPasswordController@showResetForm')->name('password.reset');
Route::post('/password/reset', 'Auth\ResetPasswordController@reset')->name('password.request');

and the problem is solved , but the thing is I did the same as my problem code in previous projects and there was no problem .

[afonte15]

What fixed this for me was editing the .env file. Had to remove the "http://localhost form APP_URL. See below. At least for me this resolved my issue.

Doesn't work
APP_URL=http://localhost

Works
APP_URL=

[developerdesks]

For this
->action('Reset Password', url(config('app.url').route('password.reset', $this->token, false)))
Add this one
->action('Reset Password', url(config('app.url'.':'.'app.port').route('password.reset', $this->token, false)))
It will work.