Pow: 'after_password_reset_path' like callback

[sfusato]

How would I go about customizing the redirect after the user submits the PasswordReset extension form?

I have a routes file where I've used some default callbacks for certain actions, but this isn't as straightforward as the default ones.

[danschultzer]

It redirects back to session_path(conn, :new) with a flash message, so only way to do do that with the current release is with a custom controller. Where would you want to redirect the user to?

[sfusato]

Oh, okay, so it's gonna be a custom controller. Hoped there was an 'easier' way out that I didn't see.

The way Pow is set up by default is with the highest security defaults (I think this is a good thing!). I want to relax those a bit in my app scenario. A longer read: https://blog.codinghorror.com/the-god-login/#telltheuserwhentheiremaildoesntexist

[danschultzer]

That's a good point, and if registration is permitted then there's no point in not letting the user know whether the e-mail exists or not since that info is already leaked in registration.

Would this be solved if PowResetPassword extension automatically checks whether the registration path exists (like how PowAssent check if registration is enabled)? If the registration path exists, then the changeset would be rendered with the error, otherwise it would redirect with the the default success message.

[sfusato]

I think that would be a good usability change. And it wouldn't leak out anything that isn't already. In case registration is disabled (by way of removing the route), no harm is done.

[danschultzer]

You can try #314, should resolve this.

[sfusato]

Awesome. Just pulled from the github branch and tested it. It's what I wanted to achieve.

Only needed to add the following to pow_reset_password/reset_password/new.html.eex to display the message:

<%= if get_flash(@conn, :error) do %>
  <div class="alert alert-danger" role="alert"><%= get_flash(@conn, :error) %></div>
<% end %>

Thank you!

[danschultzer]

Released in v1.0.14