# Invalid password reset link **URL:** \ **Category:** Development\ **Tags:** koa\ **Created:** [June 11, 2021, 6:53am UTC](https://discuss.openedx.org/t/invalid-password-reset-link/5152 "2021-06-11T06:53:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![vzahradnik](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/vzahradnik/32/2521_2.png) [@vzahradnik](https://discuss.openedx.org/u/vzahradnik)\ **Post date:** [June 11, 2021, 6:53am UTC](https://discuss.openedx.org/t/invalid-password-reset-link/5152/1 "2021-06-11T06:53:43Z")
Hello, I stumbled on one issue, and I’m not sure whether I discovered a bug, or perhaps I do something wrong. When user enters their credentials incorrectly too many times, they are prompted with a screen like this: ![Password-recovery](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/9/9bd8ac9534ae1031d9190c66006b9e49c8149479.png) The hyperlink in “you can reset your password here…” points to a non existing site page: http://\/reset ![Comeno-page-doesnt-exist](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/4/432df8436338d6daa7a0ee9457b0ba94115d27d7.png) I did some investigation, and it looks like there’s another url which works: http://\/password\_assistance ![password-assistance](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/3/3154fd9937399c15466d8ac6de67ff318eb705ca.png) This url seems to be the correct one. The form “Password assistance” is displayed also on [edx.org](http://edx.org), which I take as a ground source of truth. The file responsible for rendering this incorrect url (/reset instead of /password\_assistance) is located here: `edx-platform/openedx/core/djangoapps/user_authn/views/login.py` Now back to my questions: - Do you face the same issue when usign latest Open edX? - Is it a bug, or I just misconfigured something on my end (I’m using native install) - If it’s a bug, where should I report it? - Is there a way how to temporarily modify the file inside edX comprehensive theme? I think views can’t be overridden. Thanks for all your answers. ---
**Author:** ![vzahradnik](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/vzahradnik/32/2521_2.png) [@vzahradnik](https://discuss.openedx.org/u/vzahradnik)\ **Post date:** [June 17, 2021, 6:38am UTC](https://discuss.openedx.org/t/invalid-password-reset-link/5152/2 "2021-06-17T06:38:16Z")
For now, I fixed my issue with this script: ```auto sudo sed -i -e "s/\/reset/\/password_assistance/g" /edx/app/edxapp/edx-platform/openedx/core/djangoapps/user_authn/views/login.py sudo /edx/bin/supervisorctl reload ``` ---
**Author:** ![arbrandes](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/arbrandes/32/158_2.png) [@arbrandes](https://discuss.openedx.org/u/arbrandes)\ **Post date:** [June 17, 2021, 6:30pm UTC](https://discuss.openedx.org/t/invalid-password-reset-link/5152/3 "2021-06-17T18:30:01Z")
Hi @vzahradnik! > [@vzahradnik](#): > > - Is it a bug, or I just misconfigured something on my end (I’m using native install) > - If it’s a bug, where should I report it? I haven’t confirmed it, but it sure looks like a bug. This is Koa, right? Would it be too much to ask for you to confirm that it’s still an issue in Lilac? If it is, the best place for you to open a bug would be in the build-test-release working group’s [issue board](https://github.com/openedx/build-test-release-wg/issues). (The reason I ask for Lilac confirmation is that the community-run group only supports the latest release - Koa is now unsupported.) ---
**Author:** ![vzahradnik](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/vzahradnik/32/2521_2.png) [@vzahradnik](https://discuss.openedx.org/u/vzahradnik)\ **Post date:** [June 17, 2021, 9:26pm UTC](https://discuss.openedx.org/t/invalid-password-reset-link/5152/4 "2021-06-17T21:26:23Z")
I will definitely check. I didn’t know Lilac was already released, probably I’ll upgrade too. ---
**Author:** ![jill](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/jill/32/3188_2.png) [@jill](https://discuss.openedx.org/u/jill)\ **Post date:** [June 18, 2021, 1:21am UTC](https://discuss.openedx.org/t/invalid-password-reset-link/5152/5 "2021-06-18T01:21:59Z")
> [@vzahradnik](#): > > This url seems to be the correct one. The form “Password assistance” is displayed also on [edx.org](http://edx.org), which I take as a ground source of truth. [edx.org](http://edx.org) uses the `/reset` link: [Authn | edX](https://authn.edx.org/reset) This is provided by the new frontend app, [`frontend-app-authn`](https://github.com/edx/frontend-app-authn/search?q=RESET_PAGE), but I’m not sure exactly how this MFE gets installed, or which releases are using it. > [@vzahradnik](#): > > - Do you face the same issue when usign latest Open edX? These sandboxes were deployed with the [`openedx_native.yml` playbook](https://github.com/edx/configuration/blob/master/playbooks/openedx_native.yml), and their “reset password” links use `/reset` and are working ok. - [pr27372.sandbox.opencraft.hosting/login](https://pr27372.sandbox.opencraft.hosting/login) – based on recent `master` - [mfeplayground.opencraft.hosting/login](https://mfeplayground.opencraft.hosting/login) – based on `open-release/lilac.master` - [branding-theming-sandbox.opencraft.hosting/login](https://branding-theming-sandbox.opencraft.hosting/login) – based on `open-release/koa.3` They all share similar ansible variables, and I believe the relevant ones here are: ```yaml EDXAPP_FEATURES: ENABLE_COMBINED_LOGIN_REGISTRATION: true EDXAPP_ENABLE_COMPREHENSIVE_THEMING: true EDXAPP_COMPREHENSIVE_THEME_DIRS: - /edx/var/edxapp/themes ``` The `branding-theming-sandbox` also adds these for the edx-simple-theme: ```yaml EDXAPP_COMPREHENSIVE_THEME_SOURCE_REPO: https://github.com/open-craft/edx-simple-theme/ EDXAPP_COMPREHENSIVE_THEME_VERSION: master EDXAPP_DEFAULT_SITE_THEME: simple-theme SIMPLETHEME_ENABLE_DEPLOY: true SIMPLETHEME_SASS_OVERRIDES: [/* snip: lots of things */] SIMPLETHEME_STATIC_FILES_URLS: [/* snip: few of these too */] ``` > [@vzahradnik](#): > > - Is there a way how to temporarily modify the file inside edX comprehensive theme? I think views can’t be overridden. Unfortunately the new MFEs aren’t themable with comprehensive themes, you have to [replace the whole package to change anything](https://edx.readthedocs.io/projects/edx-developer-docs/en/latest/developers_guide/micro_frontends_in_open_edx.html#overriding-brand-specific-elements). But since this appears to be something we need to fix, then it would be better to fix it upstream than for you to have to maintain a custom fix. > [@vzahradnik](#): > > - Is it a bug, or I just misconfigured something on my end (I’m using native install) It definitely sounds like a bug, but I’m curious as to why we’re not seeing it too. Can you provide some more details about your installation process? - native or [Tutor](https://docs.tutor.overhang.io/)? (You said native, so just confirming.) - `EDX_PLATFORM_VERSION` - `configuration_version` - playbook used - any non-sensitive ansible variables that you can share ---
**Author:** ![vzahradnik](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/vzahradnik/32/2521_2.png) [@vzahradnik](https://discuss.openedx.org/u/vzahradnik)\ **Post date:** [June 18, 2021, 5:54am UTC](https://discuss.openedx.org/t/invalid-password-reset-link/5152/6 "2021-06-18T05:54:36Z")
Thanks for detailed comments. - We’re using native install - Koa/3 - `configuration_version` - What exactly do you mean? - playbooks used - Default playbooks deployed with native install script - We didn’t modify ansible stack. Most of our modifications are in `lms.yml` and `studio.yml`; as far as I can tell there’s no config variable to specify the `/reset` URL. Please let me know if you need more details. I can try to dig it up. ---
**Author:** ![vzahradnik](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/vzahradnik/32/2521_2.png) [@vzahradnik](https://discuss.openedx.org/u/vzahradnik)\ **Post date:** [June 18, 2021, 5:59am UTC](https://discuss.openedx.org/t/invalid-password-reset-link/5152/7 "2021-06-18T05:59:28Z")
> [@jill](#): > > These sandboxes were deployed with the [`openedx_native.yml` playbook](https://github.com/edx/configuration/blob/master/playbooks/openedx_native.yml), and their “reset password” links use `/reset` and are working ok. One more thing for you to check: - There are two ways how password reset works - The first way is through html forms, in which case /reset works also for me - The second way is when you want to access direct link www.yourdomain/reset. I got to this link only when I entered my password wrong too many times. Most users don’t face this issue as long as they know their password to edX ---
**Author:** ![jill](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/jill/32/3188_2.png) [@jill](https://discuss.openedx.org/u/jill)\ **Post date:** [June 18, 2021, 6:43am UTC](https://discuss.openedx.org/t/invalid-password-reset-link/5152/8 "2021-06-18T06:43:19Z")
> [@vzahradnik](#): > > The second way is when you want to access direct link www.yourdomain/reset. I got to this link only when I entered my password wrong too many times. Most users don’t face this issue as long as they know their password to edX Interesting. That `/reset` link works fine for me if I click on it from the `/login` page, but **only in that browser session**. It 404s for me if I open it in a new window, and will probably break for you too if you click on these links: [master /reset](https://pr27372.sandbox.opencraft.hosting/reset), [lilac.master /reset](https://mfeplayground.opencraft.hosting/reset) and [koa.3 /reset](https://branding-theming-sandbox.opencraft.hosting/reset) I believe this is because of the Javascript client-side routing that React is doing for the MFE. This StackOverflow post explains it well: [React-router urls don’t work when refreshing or writing manually: answer](https://stackoverflow.com/a/36623117/4302112) My guess is, [edx.org](http://edx.org) solved this by registering the `/reset` URL on the server side too, so that [authn.edx.org/reset](https://authn.edx.org/reset) is also directed to the MFE. But by default, only `/login` and `/register` are known on the server side, as you found by changing [user\_authn/views/login.py](https://discuss.openedx.org/t/invalid-password-reset-link/5152/2). To fix this in master, the change needs to be made in a slightly different place: [user\_authn/urls.py](https://github.com/edx/edx-platform/blob/master/openedx/core/djangoapps/user_authn/urls.py#L21-L22), and we should support both `/reset` and `/password_assistance`. Would you like to submit a PR to get this fixed for `master`, and then we can pull it into `lilac`?