0

Magento 2 forgot password doesn't check email exist or not. It gives the message

If there is an account associated with xxxx@xxxx.com you will receive an email with a link to reset your password.

It should give an error message if email not exist.

1

That would be security risk as any one can check if some user have account on the website or not . Then he just have to guess a password . So message should be always success .

If you want to change it , you can modify the logic in magento/module-customer/Model/AccountManagement.phpin initiatePasswordReset method where customer is loaded . you can check if customer exists and throw error like

$this->messageManager->addErrorMessage(
                    __('The email address is does not exist. Verify the email address and try again.')

But i would strongly suggest not to change this logic as that would be security flaw

  • You are right, that would be a security risk. – Amatya Trivedi Jul 25 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.