Password change without the password reset email about express-stormpath HOT 13 CLOSED

This is a great request. I've tried to support it but I ran into some problems, I have to pause for now but look at commit be3efae on the gh-20 branch. See comments in the commit. Basically I tried to render the form w/o reading the spreset token (which won't exist in this use case) but when I post that form I'm getting a a 404 not found.

from express-stormpath.

I'm not working on this feature right now on my side, but if I'm getting there before you I'll pick up your branch to see what I can do.

from express-stormpath.

Thanks @lemieux ! I'll post back too when I pick this up

from express-stormpath.

I just thought of something about this... this is not a good idea.

If this was implemented, a user could have his password changed by anyone who has access to his computer while logged in... the form doesn't ask for the previous password.

This should be closed. The proper way to do this would be to have a real password change view I guess.

from express-stormpath.

Agreed -- going to close this.

from express-stormpath.

What about forcing the user to type in his old password and then ask for the new password & confirm new password? is this supported by stormpath?

from express-stormpath.

Hey @bartzilla, you can indeed do this, but that functionality isn't pre-built into express-stormapth (a page, for instance). What you'd need to do is:

• Create a route / view that force a user to change their password.
• In your code, just update the user's password and save their account, for instance:

req.user.password = 'newpassword';
req.user.save();

from express-stormpath.

Hey @bartzilla , thanks for the question! As @rdegges mentioned we don't have an out-of-the-box form for a logged-in password change form, but it's really easy to roll this into your profile page. We have an example profile page here, you'd just need to modify it a bit to add the change password fields:

https://github.com/stormpath/express-stormpath-sample-project/

Hope this helps!

from express-stormpath.

Hey @robertjd and @rdegges very useful information indeed. I managed to implement the use case. Thank you very much your direction and quick response.
Best!

from express-stormpath.

Awesome @bartzilla , glad you've got it working now! Always happy to help :)

from express-stormpath.

@rdegges Can you do this with just plain node?

"Hey @bartzilla, you can indeed do this, but that functionality isn't pre-built into express-stormapth (a page, for instance). What you'd need to do is:

Create a route / view that force a user to change their password.
In your code, just update the user's password and save their account, for instance:
req.user.password = 'newpassword';
req.user.save();
@robertjd"

from express-stormpath.

@EricMentele yep! Same exact thing, you can do it with an account, eg:

account.password = 'blah';
account.save();

from express-stormpath.

@rdegges thanks! Got it working.

from express-stormpath.