0

Magento 2 forgot password doesn't check email exist or not. It gives the message

If there is an account associated with xxxx@xxxx.com you will receive an email with a link to reset your password.

It should give an error message if email not exist.

1
  • did you ever find a solution to this?
    – Devidas
    Jan 28 '20 at 10:11
1

That would be security risk as any one can check if some user have account on the website or not . Then he just have to guess a password . So message should be always success .

If you want to change it , you can modify the logic in magento/module-customer/Model/AccountManagement.phpin initiatePasswordReset method where customer is loaded . you can check if customer exists and throw error like

$this->messageManager->addErrorMessage(
                    __('The email address is does not exist. Verify the email address and try again.')

But i would strongly suggest not to change this logic as that would be security flaw

1
  • You are right, that would be a security risk. Jul 25 '19 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.