This is a Magento CE 2.2.5 project

We've found bug, reported here https://github.com/magento/magento2/issues/20148

Steps to reproduce

  • Create new customer in admin with associated website / store different than default store
  • Welcome mail with a link to "create password" feature is then sent to new customer
  • Create password works fine, and the customer is redirected to associated store login page

Expected result

  • After login, customer should be redirected to homepage (or dashboard, if configured... or any other page) of associated store

Actual result

  • After login, customer is redirected to homepage of default store

We've tried to fix this by forcing the right redirect with a plugin approach (afterExecute in \Magento\Customer\Controller\Account\LoginPost) & observer approach (controller_action_postdispatch_customer_account_loginPost event) but it still redirected to default store homepage

It seems this doesn't occur in 2.2.7 or higher versions. Any ideas to fix this without having to update the whole application?

  • Problem persists in Magento CE 2.2.6 Jan 11, 2019 at 8:44
  • Problem persists in Magento CE 2.2.7 Jan 11, 2019 at 13:20

1 Answer 1


As a workaround for this, we are rewriting Magento\Customer\Model\AccountManagement resetPassword(), setting customer as logged in at the end of that function, this way the flow doesn't reach the point where redirect bug occurs

class AccountManagement extends \Magento\Customer\Model\AccountManagement

    /** Need to copy here, cause of private scope */
    private function validateResetPasswordToken($customerId, $resetPasswordLinkToken)

        $customerRegistry = ObjectManager::getInstance()->get(\Magento\Customer\Model\CustomerRegistry::class);
        if (empty($customerId) || $customerId < 0) {
            throw new InputException(
                    'Invalid value of "%value" provided for the %fieldName field.',
                    ['value' => $customerId, 'fieldName' => 'customerId']
        if (!is_string($resetPasswordLinkToken) || empty($resetPasswordLinkToken)) {
            $params = ['fieldName' => 'resetPasswordLinkToken'];
            throw new InputException(__('%fieldName is a required field.', $params));

        $customerSecureData = $customerRegistry->retrieveSecureData($customerId);
        $rpToken = $customerSecureData->getRpToken();
        $rpTokenCreatedAt = $customerSecureData->getRpTokenCreatedAt();

        if (!Security::compareStrings($rpToken, $resetPasswordLinkToken)) {
            throw new InputMismatchException(__('Reset password token mismatch.'));
        } elseif ($this->isResetPasswordLinkTokenExpired($rpToken, $rpTokenCreatedAt)) {
            throw new ExpiredException(__('Reset password token expired.'));

        return true;

     * Using ObjectManager here to simplify the rewrite, 
     * so we dont't need to define constructor class 
    public function resetPassword($email, $resetToken, $newPassword)
        $customerRepository = ObjectManager::getInstance()->get(\Magento\Customer\Api\CustomerRepositoryInterface::class);
        $customerRegistry = ObjectManager::getInstance()->get(\Magento\Customer\Model\CustomerRegistry::class);
        $customerSession = ObjectManager::getInstance()->get(\Magento\Customer\Model\Session::class);

        $customer = $customerRepository->get($email);
        //Validate Token and new password strength
        $this->validateResetPasswordToken($customer->getId(), $resetToken);
        //Update secure data
        $customerSecure = $customerRegistry->retrieveSecureData($customer->getId());

        // login customer

        return true;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.