Passing "reset_url" to reset password endpoint does not work

[andriusign]

Trying to access path /auth/password/request gives the following error:

Error:
{"errors":[{"message":"Url "https://example.com/reset-password" can't be used to reset passwords.","extensions":{"code":"INVALID_PAYLOAD"}}]}

Request headers:
headers:
email: "user@email.com"
reset_url: "https://example.com/reset-password"

I am sure this was working previously. Did this functionality get removed? If so, why?

---

Project details

Directus Version: 9.0.0-rc.51
Environment: production
OS: Linux 4.15.0-29-generic
Node: 14.16.0

[rijkvanzanten]

You have to specify the allowed URLs in PASSWORD_RESET_URL_ALLOW_LIST. See https://docs.directus.io/reference/environment-variables/#security.

This was added to ensure strangers couldn't request a password for another account with a fake reset url 👍🏻

[rijkvanzanten]

You can use a CSV of values in there (and/or prefix it with array:) 👍🏻

[rijkvanzanten]

Does the url need to be absolute or can it be relative?

Can be either

[andriusign]

I have put these settings to .env file, reload reload Docker containers, but Directus is not picking up variable from environment:

.env file:

[rijkvanzanten]

Could this be "just" a docker/env thing? I tried this locally (given; outside of docker) and it seems to work as expected

[andriusign]

All good now. Had to rebuild after changing .env. Since you have to specify the full path starting with http, otherwise Directus complains, this also works well in .env file.

PASSWORD_RESET_URL_ALLOW_LIST="${PUBLIC_WEB_URL}/change-password"
USER_INVITE_URL_ALLOW_LIST="${PUBLIC_WEB_URL}/confirm-registration"

${PUBLIC_WEB_URL} is the url of my front-end application.

[Yakito]

Hi! is there any way this can be achieved in a Directus Cloud instance since we can't set envs there? Thanks!

[albsa]

Did you figure this out?

[alpha-mo]

You have to specify the allowed URLs in PASSWORD_RESET_URL_ALLOW_LIST. See https://docs.directus.io/reference/environment-variables/#security.

This was added to ensure strangers couldn't request a password for another account with a fake reset url 👍🏻

was it not possible to have an example in the Docs? it feels like documenting the "forgot password" is poor.