Class PasswordResetConfigurer

java.lang.Object
com.codename1.backend.security.SecurityConfigurer
com.codename1.backend.security.PasswordResetConfigurer
public final class PasswordResetConfigurer extends SecurityConfigurer

The pages of a password reset by mail.

http.formLogin(Customizer.withDefaults())
    .passwordReset(Customizer.withDefaults());

cn1.security.base-url=https://example.com

GET /forgot-password asks for a user name and POST /forgot-password mails that user a link, answering the same whether or not there is such a user. The link opens GET /reset-password, which asks for the new password, and POST /reset-password sets it and sends the user to the sign-in page. All four are open to everyone, whatever the authorization rules say.

The work is a PasswordResetService's: the one given here, or the application's bean of that type.

The link is mailed to somebody other than whoever asked for it, so it is never built from the request's Host header, which the caller chooses. It starts with cn1.security.base-url, or what baseUrl is given. With neither, a request to localhost gets a link to itself, which is what a developer's machine needs, and any other request is refused with an error that names the setting.

How often

Asking is counted for the client's network and for the name asked about, 5 in 15 minutes each unless attemptLimiter(RateLimiter) says otherwise, and more are answered 429. The count for a name is kept whether or not there is such a user, so it tells nobody which there are; it is what stops one person's mailbox being filled from many addresses.

  • Field Details

    • BASE_URL

      public static final String BASE_URL
      The setting that holds the address the server is reached at from outside, https://example.com, with no path.
      See Also:

  • Method Details

    • service

      public PasswordResetConfigurer service(PasswordResetService service)
      What mails the link and sets the password, in place of the application's bean.

    • requestUrl

      public PasswordResetConfigurer requestUrl(String requestUrl)
      Where a reset is asked for; /forgot-password unless set.

    • resetUrl

      public PasswordResetConfigurer resetUrl(String resetUrl)
      Where the mailed link leads and the new password is posted; /reset-password unless set.

    • baseUrl

      public PasswordResetConfigurer baseUrl(String baseUrl)
      The address the server is reached at from outside, in place of the cn1.security.base-url setting.

    • servePages

      public PasswordResetConfigurer servePages(boolean servePages)
      False leaves the two GET pages to the application, which then posts the fields username, and token, password and confirm, to the same paths.

    • attemptLimiter

      public PasswordResetConfigurer attemptLimiter(RateLimiter attemptLimiter)
      What counts requests for a link, in place of the application's RateLimiter bean and of the count kept in this process; null to count none.

    • init

      public void init(HttpSecurity http)
      Description copied from class: SecurityConfigurer
      Shares what other parts need to know; nothing by default.
      Overrides:
      init in class SecurityConfigurer