Anytime! Yes, sorry, we'll move our home page into our group protected by the auth middleware in the next lesson (6.0). So, that warning specifically on the home page will go away in the next lesson.

Anytime, Aaron!!

Alrighty, was able to track down the issue! So this was happening as a side-effect to the Referrer-Policy: no-referrer within reset method of the forgot password controller.

When we call response.redirect().back(), which happens on our behalf during request validation handling, it reads from the referer header and redirects the user back to that page. With our Referrer-Policy on this particular form set to no-referrer we're telling the browser not to share that referrer with anyone. This is a security step to prevent the token from being leaked via the referrer.

To properly correct this and also allow any password errors to show, we want to keep the no-referrer designation and instead update how we're handling our validation errors.

First, let's move the password reset token into a flash message, rather than passing through the form. This will allow us to keep it out of our redirect url should we get any validation errors on submit.

async reset({ params, inertia, response, session }: HttpContext) {
  // will be in the params if coming from email
  // will be in flash messages if coming from errored validation
  const token = params.value ?? session.flashMessages.get('password_reset_token')
  const { isValid, user } = await VerifyPasswordResetToken.handle({
    encryptedValue: token,
  })

  // flash it to the session store
  session.flash('password_reset_token', token)
  // keep this to keep things secure
  response.header('Referrer-Policy', 'no-referrer')

  return inertia.render('auth/forgot_password/reset', {
    email: user?.email,
    isValid,
  })
}

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
    
  

Then, configure the update method to read the token from the flash message store instead of our form. We'll also want to manually capture and handle the validation error so we can specify where the user should be redirected to, reflashing the token so it continues to be available for us to use.

@inject()
async update({ request, response, session, auth }: HttpContext, webLogin: WebLogin) {
  let data: Infer<typeof passwordResetValidator>

  try {
    data = await request.validateUsing(passwordResetValidator)
  } catch (error) {
    // manually catch any validation errors that were thrown
    if (error.code === 'E_VALIDATION_ERROR' && 'messages' in error) {
      // reflash the user's password reset token so it is available to use again
      session.reflashOnly(['password_reset_token'])
      // flash the validation errors so they display to the user
      session.flashValidationErrors(error)
      // redirect to the correct page
      return response.redirect(`/forgot-password/reset`)
    }
    throw error
  }

  // grab the token from the flash message store to use
  const token = session.flashMessages.get('password_reset_token')
  const user = await ResetPassword.handle({ data, token })

  await auth.use('web').login(user)
  await webLogin.clearRateLimits(user.email)

  session.flash('success', 'Your password has been updated')

  return response.redirect().toRoute('courses.index')
}

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
    
  

Next, since our token is no longer in our data, we'll update the ResetPassword action to accept it separately.

type Params = {
  data: Infer<typeof passwordResetValidator>
  token: string
}

export default class ResetPassword {
  static async handle({ data, token }: Params) {
    const { isValid, user } = await VerifyPasswordResetToken.handle({ encryptedValue: token })

    if (!isValid) {
      throw new Exception('The password reset token provided is invalid or expired', {
        status: 403,
        code: 'E_UNAUTHORIZED',
      })
    }

    await user!.merge({ password: data.password }).save()
    await ExpirePasswordResetTokens.handle({ user: user! })

    return user!
  }
}

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
    
  

Then, since the token will come from our flash message store on any validation redirects and not the route params, we'll make that route parameter optional.

router.get('/reset/:value?', [ForgotPasswordsController, 'reset']).as('reset')

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
    
  

Lastly, since we're no longer passing the token to our page or form, we can remove it from our validator.

export const passwordResetValidator = vine.compile(
  vine.object({
    value: vine.string(),
    password: vine.string().minLength(8),
  })
)

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
    
  

With all that, things should be behaving properly! Terribly sorry I missed accounting for that. The no-referrer was something I added in after the fact and failed to recognize it'd have that kind of impact. However, it is definitely something we want to keep.

You can find the full diff of my commit for this here:
https://github.com/adocasts/building-with-adonisjs-and-inertia/commit/2f87a54cd84886e6dfffad01568153e2f8fe24a1

Oh hey, haha! Seems we both found the culprit around the same time! 😄

I chose to take the overkill approach in my commit & other comment, though using flash messages instead of a cookie.