Class PasswordResetService

java.lang.Object
com.codename1.backend.security.mail.PasswordResetService
public final class PasswordResetService extends Object

Resets a forgotten password by mail.

@Bean
PasswordResetService passwordReset(OneTimeTokenService tokens, MailSender mail,
        JdbcUserDetailsManager users, PasswordEncoder encoder) {
    return new PasswordResetService(tokens, mail, users, users, encoder);
}

request(String, String) mails a link that works once and for half an hour; reset(String, String) takes the token from that link and the new password. http.passwordReset() puts both behind pages; an application with pages of its own calls the two methods from its controllers.

request(String, String) returns the same way whether or not there is such a user, and whether or not the mail could be sent, so that asking tells nobody which accounts exist. The mail is handed to the server's mail queue, so the call never waits for a mail server. For an account that exists it still makes a token and stores it, which somebody timing many requests could measure: limit how often it can be called. The pages do, a controller of the application's own has to.

A reset removes the user's remember-me sign-ins when the service is given their store. A session that is already signed in stays so until it ends.

The mail is plain by default. Name a template to send the application's own: it is rendered with link, username and minutes.

  • Field Details

  • Constructor Details

  • Method Details

    • addressResolver

      public PasswordResetService addressResolver(EmailAddressResolver addressResolver)
      Where each user's mail goes. Without one, a user name that is an address is used and other users are sent nothing.

    • rememberMeTokens

      public PasswordResetService rememberMeTokens(PersistentTokenRepository repository)
      The remember-me sign-ins to remove when a password is reset.

    • validityMinutes

      public PasswordResetService validityMinutes(int validityMinutes)
      How long a link works; 30 minutes unless set.

    • minimumLength

      public PasswordResetService minimumLength(int minimumLength)
      The shortest password reset(String, String) takes; 8 unless set.

    • subject

      public PasswordResetService subject(String subject)
      The subject of the mail.

    • template

      public PasswordResetService template(String view)
      The template the mail is rendered from, such as mail/password-reset, in place of the plain mail.

    • getMinimumLength

      public int getMinimumLength()
      The shortest password reset(String, String) takes.

    • request

      public void request(String username, String resetUrl)

      Mails username a link to resetUrl with a token parameter added. Does nothing, and says nothing, when there is no such user, the account is disabled or it has no address.

      Parameters
      • username: the account, as the person asking typed it
      • resetUrl: the whole address of the page that takes the new password, https://example.com/reset-password. Build it from the server's configured address, never from the request's Host header: that header is the caller's to choose, and the link is mailed to somebody else.

    • isAcceptable

      public boolean isAcceptable(String password)
      Whether password is one reset(String, String) would take.

    • reset

      public boolean reset(String token, String newPassword)
      Sets the password of the user token was mailed to. False when the token is not good -- wrong, expired or used -- or the password is too short. A password that is too short leaves the token good for another try. A token is used up before the password is stored, so that it cannot set two: if the store then fails, this throws what the store threw and the user asks for another link.