[GH-ISSUE #620] Forget password Options for OAuth Users

kerem commented

2026-02-26 18:45:41 +03:00

Owner

Originally created by @luckyklyist on GitHub (Nov 2, 2023).
Original GitHub issue: https://github.com/documenso/documenso/issues/620

Originally assigned to: @luckyklyist on GitHub.

Issue Description

For OAuth users, there is no password set in the database. Therefore, the 'Forgot Password' page will not be of any use to them. There should be an option to implement the creation of a password for OAuth users if they haven't set one would be a good idea.

Steps to Reproduce

Log in with the OAuth provider Google, go to the profile page, and click on the 'Password' tab.

Expected Behavior

There should be a way for the OAuth user to set the password.

Current Behavior

When trying to add the password, the current password for the OAuth user is null, so there won't be forget password functionality for the oauth user.

Screenshots (optional)

Operating System [e.g., Windows 10]

No response

Browser [e.g., Chrome, Firefox]

Brave

Version [e.g., 2.0.1]

No response

Please check the boxes that apply to this issue report.

I have searched the existing issues to make sure this is not a duplicate.
I have provided steps to reproduce the issue.
I have included relevant environment information.
I have included any relevant screenshots.
I understand that this is a voluntary contribution and that there is no guarantee of resolution.

Originally created by @luckyklyist on GitHub (Nov 2, 2023). Original GitHub issue: https://github.com/documenso/documenso/issues/620 Originally assigned to: @luckyklyist on GitHub. ### Issue Description For OAuth users, there is no password set in the database. Therefore, the 'Forgot Password' page will not be of any use to them. There should be an option to implement the creation of a password for OAuth users if they haven't set one would be a good idea. ### Steps to Reproduce Log in with the OAuth provider Google, go to the profile page, and click on the 'Password' tab. ### Expected Behavior There should be a way for the OAuth user to set the password. ### Current Behavior When trying to add the password, the current password for the OAuth user is null, so there won't be forget password functionality for the oauth user. ### Screenshots (optional) <img width="1335" alt="Screenshot 2023-11-02 at 1 31 40 PM" src="https://github.com/documenso/documenso/assets/35479077/c2b15636-7fd2-43cd-baea-fa64b386be37"> <img width="424" alt="Screenshot 2023-11-02 at 1 39 51 PM" src="https://github.com/documenso/documenso/assets/35479077/0772c6b6-6016-438a-bd0b-cd4df5c88a60"> ### Operating System [e.g., Windows 10] _No response_ ### Browser [e.g., Chrome, Firefox] Brave ### Version [e.g., 2.0.1] _No response_ ### Please check the boxes that apply to this issue report. - [X] I have searched the existing issues to make sure this is not a duplicate. - [X] I have provided steps to reproduce the issue. - [X] I have included relevant environment information. - [X] I have included any relevant screenshots. - [X] I understand that this is a voluntary contribution and that there is no guarantee of resolution.

kerem

2026-02-26 18:45:41 +03:00

closed this issue
added the
type: bug

Stale
labels

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@luckyklyist commented on GitHub (Nov 2, 2023):

After the approval of this issue, I would like to work on it.

@luckyklyist commented on GitHub (Nov 2, 2023): After the approval of this issue, I would like to work on it.

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@Mythie commented on GitHub (Nov 2, 2023):

Can we confirm if the forgot password flow works? So when signed out click on forgotten password and work from there :)

@Mythie commented on GitHub (Nov 2, 2023): Can we confirm if the forgot password flow works? So when signed out click on forgotten password and work from there :)

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@luckyklyist commented on GitHub (Nov 2, 2023):

Yes, the 'Forgot Password' functionality is working. OAuth users can reset their password from there.

Should I add another tab to the settings page for 'Forgot Password'? Would that be beneficial for the UX?
Screenshot 2023-11-02 at 3 57 58 PM

@luckyklyist commented on GitHub (Nov 2, 2023): Yes, the 'Forgot Password' functionality is working. OAuth users can reset their password from there. Should I add another tab to the settings page for 'Forgot Password'? Would that be beneficial for the UX? <img width="1323" alt="Screenshot 2023-11-02 at 3 57 58 PM" src="https://github.com/documenso/documenso/assets/35479077/f5e6c41e-1abd-4b88-9436-13a1a9087ed8">

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@Mythie commented on GitHub (Nov 2, 2023):

Reserving for a write up tomorrow on options and complications

@Mythie commented on GitHub (Nov 2, 2023): Reserving for a write up tomorrow on options and complications

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@G3root commented on GitHub (Nov 5, 2023):

@luckyklyist in the context of OAuth, the responsibility for handling passwords should lie with the OAuth provider, not the application itself. It's normal to have the password being empty in the DB. Maybe we can show a message that the passwords should be handled in the relevant OAuth provider. thoughts @Mythie ?

@G3root commented on GitHub (Nov 5, 2023): @luckyklyist in the context of OAuth, the responsibility for handling passwords should lie with the OAuth provider, not the application itself. It's normal to have the password being empty in the DB. Maybe we can show a message that the passwords should be handled in the relevant OAuth provider. thoughts @Mythie ?

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@luckyklyist commented on GitHub (Nov 5, 2023):

@luckyklyist in the context of OAuth, the responsibility for handling passwords should lie with the OAuth provider, not the application itself. It's normal to have the password being empty in the DB. Maybe we can show a message that the passwords should be handled in the relevant OAuth provider. thoughts @Mythie ?

You can set a password for the OAuth user by visiting the "Forgot Password" link. However, the issue arises when the OAuth user encounters the "Change Password" tab. They might become confused because their password is null at that point, and they have to sign out to access the "Forgot Password" link. Therefore, we can improve the user experience in this area.

@luckyklyist commented on GitHub (Nov 5, 2023): > @luckyklyist in the context of OAuth, the responsibility for handling passwords should lie with the OAuth provider, not the application itself. It's normal to have the password being empty in the DB. Maybe we can show a message that the passwords should be handled in the relevant OAuth provider. thoughts @Mythie ? You can set a password for the OAuth user by visiting the "Forgot Password" link. However, the issue arises when the OAuth user encounters the "Change Password" tab. They might become confused because their password is null at that point, and they have to sign out to access the "Forgot Password" link. Therefore, we can improve the user experience in this area.

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@NuggaN85 commented on GitHub (Nov 6, 2023):

How do I delete my account and test files?

@NuggaN85 commented on GitHub (Nov 6, 2023): How do I delete my account and test files?

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@Mythie commented on GitHub (Nov 10, 2023):

Reserving for a write up tomorrow on options and complications

I failed this hard.

Since we're linking OAuth accounts to existing accounts (if they exist) we should allow for the password to be set or updated from the dashboard. That said we should retain the "Current Password" field for cases where a bad actor is attempting account takeover by stealing cookies or similar.

By requiring the current password we can ensure a bad actor can not simply reset the password for a user without prior knowledge of their account password (credentials compromised).

Instead for OAuth accounts that have no password set we can look to disable the "Current Password" with a tooltip explaining that they don't currently have a current password as they're using an OAuth provider. We then should update our updatePassword handler to accept an empty current password if the value is null within the database.

@Mythie commented on GitHub (Nov 10, 2023): > Reserving for a write up tomorrow on options and complications I failed this hard. Since we're linking OAuth accounts to existing accounts (if they exist) we should allow for the password to be set or updated from the dashboard. That said we should retain the "Current Password" field for cases where a bad actor is attempting account takeover by stealing cookies or similar. By requiring the current password we can ensure a bad actor can not simply reset the password for a user without prior knowledge of their account password (credentials compromised). Instead for OAuth accounts that have no password set we can look to disable the "Current Password" with a tooltip explaining that they don't currently have a current password as they're using an OAuth provider. We then should update our `updatePassword` handler to accept an empty current password if the value is `null` within the database.

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@luckyklyist commented on GitHub (Nov 11, 2023):

@Mythie , should we now include a field in the dashboard to allow OAuth users to set their password ?

@luckyklyist commented on GitHub (Nov 11, 2023): @Mythie , should we now include a field in the dashboard to allow OAuth users to set their password ?

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@Mythie commented on GitHub (Nov 20, 2023):

Yep as per above please! If the password in the database is null then disable the current password field and only allow the new password fields.

The tRPC handler will also need to be updated to accomodate for this.

@Mythie commented on GitHub (Nov 20, 2023): Yep as per above please! If the password in the database is `null` then disable the current password field and only allow the new password fields. The tRPC handler will also need to be updated to accomodate for this.

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Dec 20, 2023):

This issue has not seen activity for a while. It will be closed in 30 days unless further activity is detected

@github-actions[bot] commented on GitHub (Dec 20, 2023): This issue has not seen activity for a while. It will be closed in 30 days unless further activity is detected

kerem commented

2026-02-26 18:45:42 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Dec 27, 2023):

This issue has been closed because of inactivity.

@github-actions[bot] commented on GitHub (Dec 27, 2023): This issue has been closed because of inactivity.

kerem referenced this issue

2026-02-26 18:48:51 +03:00

[PR #173] [MERGED] fix: deprecated type checks and imports from @prisma/client #772

Rows
Columns

[GH-ISSUE #620] Forget password Options for OAuth Users #170

Issue Description

Steps to Reproduce

Expected Behavior

Current Behavior

Screenshots (optional)

Operating System [e.g., Windows 10]

Browser [e.g., Chrome, Firefox]

Version [e.g., 2.0.1]

Please check the boxes that apply to this issue report.