My customers have recently started getting the "Your password link has expired." message upon clicking the reset link in their email.
The settings are correct, I have expiration links set to expire after an hour. I recently updated to 1.9.4.0, however I'm unsure if this started then or after I opened a new website for my shop and started sharing customers globally. It was only reported to me recently, after upgrading though.
I'm logging exceptions, as suggested here: Password reset link not working showing expired
I get this:
2018-12-19T22:00:34+00:00 DEBUG (7): Mage_Core_Exception Object
(
[_messages:protected] => Array
(
)
[message:protected] => Invalid password reset token.
[string:Exception:private] =>
[code:protected] => 0
[file:protected] => /home/website/public_html/app/Mage.php
[line:protected] => 583
[trace:Exception:private] => Array
(
[0] => Array
(
[file] => /home/website/public_html/app/code/local/Mage/Customer/controllers/AccountController.php
[line] => 902
[function] => exception
[class] => Mage
[type] => ::
[args] => Array
(
[0] => Mage_Core
[1] => Invalid password reset token.
)
)
[1] => Array
(
[file] => /home/website/public_html/app/code/local/Mage/Customer/controllers/AccountController.php
[line] => 813
[function] => _validateResetPasswordLinkToken
[class] => Mage_Customer_AccountController
[type] => ->
[args] => Array
(
[0] => 0
[1] => 732a0a17e38c2a2f28b65267301f09e7
)
)
[2] => Array
(
[file] => /home/website/public_html/app/code/core/Mage/Core/Controller/Varien/Action.php
[line] => 418
[function] => resetPasswordAction
[class] => Mage_Customer_AccountController
[type] => ->
[args] => Array
(
)
)
[3] => Array
(
[file] => /home/website/public_html/app/code/core/Mage/Core/Controller/Varien/Router/Standard.php
[line] => 254
[function] => dispatch
[class] => Mage_Core_Controller_Varien_Action
[type] => ->
[args] => Array
(
[0] => resetpassword
)
)
[4] => Array
(
[file] => /home/website/public_html/app/code/community/Folio3/MaintenanceMode/Controller/Router/Standard.php
[line] => 43
[function] => match
[class] => Mage_Core_Controller_Varien_Router_Standard
[type] => ->
[args] => Array
(
[0] => Mage_Core_Controller_Request_Http Object
(
[_originalPathInfo:protected] => /customer/account/resetpassword/
[_storeCode:protected] => default
[_requestString:protected] => /customer/account/resetpassword/
[_rewritedPathInfo:protected] =>
[_requestedRouteName:protected] =>
[_routingInfo:protected] => Array
(
)
[_route:protected] => customer
[_directFrontNames:protected] => Array
(
[api] =>
)
[_controllerModule:protected] => Diglin_Username
[_isStraight:protected] =>
[_beforeForwardInfo:protected] => Array
(
)
[_internallyForwarded:protected] =>
[_paramSources:protected] => Array
(
[0] => _GET
[1] => _POST
)
[_requestUri:protected] => /customer/account/resetpassword/\?token=732a0a17e38c2a2f28b65267301f09e7
[_baseUrl:protected] =>
[_basePath:protected] =>
[_pathInfo:protected] => /customer/account/resetpassword/
[_params:protected] => Array
(
)
[_rawBody:protected] =>
[_aliases:protected] => Array
(
)
[_dispatched:protected] => 1
[_module:protected] => customer
[_moduleKey:protected] => module
[_controller:protected] => account
[_controllerKey:protected] => controller
[_action:protected] => resetpassword
[_actionKey:protected] => action
)
)
)
[5] => Array
(
[file] => /home/website/public_html/app/code/core/Mage/Core/Controller/Varien/Front.php
[line] => 172
[function] => match
[class] => Folio3_MaintenanceMode_Controller_Router_Standard
[type] => ->
[args] => Array
(
[0] => Mage_Core_Controller_Request_Http Object
(
[_originalPathInfo:protected] => /customer/account/resetpassword/
[_storeCode:protected] => default
[_requestString:protected] => /customer/account/resetpassword/
[_rewritedPathInfo:protected] =>
[_requestedRouteName:protected] =>
[_routingInfo:protected] => Array
(
)
[_route:protected] => customer
[_directFrontNames:protected] => Array
(
[api] =>
)
[_controllerModule:protected] => Diglin_Username
[_isStraight:protected] =>
[_beforeForwardInfo:protected] => Array
(
)
[_internallyForwarded:protected] =>
[_paramSources:protected] => Array
(
[0] => _GET
[1] => _POST
)
[_requestUri:protected] => /customer/account/resetpassword/\?token=732a0a17e38c2a2f28b65267301f09e7
[_baseUrl:protected] =>
[_basePath:protected] =>
[_pathInfo:protected] => /customer/account/resetpassword/
[_params:protected] => Array
(
)
[_rawBody:protected] =>
[_aliases:protected] => Array
(
)
[_dispatched:protected] => 1
[_module:protected] => customer
[_moduleKey:protected] => module
[_controller:protected] => account
[_controllerKey:protected] => controller
[_action:protected] => resetpassword
[_actionKey:protected] => action
)
)
)
[6] => Array
(
[file] => /home/website/public_html/app/code/core/Mage/Core/Model/App.php
[line] => 365
[function] => dispatch
[class] => Mage_Core_Controller_Varien_Front
[type] => ->
[args] => Array
(
)
)
[7] => Array
(
[file] => /home/website/public_html/app/Mage.php
[line] => 687
[function] => run
[class] => Mage_Core_Model_App
[type] => ->
[args] => Array
(
[0] => Array
(
[scope_code] => base
[scope_type] => website
[options] => Array
(
)
)
)
)
[8] => Array
(
[file] => /home/website/public_html/index.php
[line] => 97
[function] => run
[class] => Mage
[type] => ::
[args] => Array
(
[0] => base
[1] => website
)
)
)
[previous:Exception:private] =>
)
I'm not getting any other errors in exception.log that have to do with it.
Update 1/2/2019 After finding some time to come back to this issue, I've found that the customer ID isn't being added to the reset URL. I think this issue may have started around when I opened up a second store/website, however, I do in fact have customers shared globally.
I've done some additional testing and can confirm that the ID is being successfully grabbed from the form post. So the issue is that it's not being passed to the URL given in the email.
What the email password reset link looks like:
www.example.net/customer/account/resetpassword/?token=3f042b9d36e64ea135d778cd5c7eed64
clearly missing the id=xxx?
