Magento 2.4.4. password reset link always expired

Question

After updating to Magento 2.4.4, clicking the "Set new password" link in the "Forgot password mail" send by the system the link always shows as expired?!

Setting of "Recovery Link Expiration Period (hours) = 2 hours"

Seems like a bug to me. Does anyone see what is wrong in native Magento CreatePassword.php for example? Replacing "token" with "amp;token" does not help (as suggested by some for earlier versions)

CreatePassword.php in vendor/magento/module-customer/Controller/Account is as follows in Magento 2.4.4:

  public function __construct(
    Context $context,
    Session $customerSession,
    PageFactory $resultPageFactory,
    AccountManagementInterface $accountManagement,
    ConfirmCustomerByToken $confirmByToken = null,
    GetCustomerByToken $getByToken = null,
    CustomerRepositoryInterface $customerRepository = null
) {
    $this->session = $customerSession;
    $this->resultPageFactory = $resultPageFactory;
    $this->accountManagement = $accountManagement;
    $this->confirmByToken = $confirmByToken
        ?? ObjectManager::getInstance()->get(ConfirmCustomerByToken::class);
    $this->getByToken = $getByToken
        ?? ObjectManager::getInstance()->get(GetCustomerByToken::class);
    $this->customerRepository = $customerRepository
        ?? ObjectManager::getInstance()->get(CustomerRepositoryInterface::class);

    parent::__construct($context);
}

/**
 * Resetting password handler
 *
 * @return Redirect|Page
 */
public function execute()
{
    $resetPasswordToken = (string)$this->getRequest()->getParam('token');
    $customerId = (int)$this->getRequest()->getParam('id');
    $isDirectLink = $resetPasswordToken != '';
    if (!$isDirectLink) {
        $resetPasswordToken = (string)$this->session->getRpToken();
        $customerId = (int)$this->session->getRpCustomerId();
    }

    try {
        $this->accountManagement->validateResetPasswordLinkToken($customerId, $resetPasswordToken);
        $this->confirmByToken->resetCustomerConfirmation($customerId);

        // Extend token validity to avoid expiration while this form is
        // being completed by the user.
        $customer = $this->customerRepository->getById($customerId);
        $this->accountManagement->changeResetPasswordLinkToken($customer, $resetPasswordToken);

        if ($isDirectLink) {
            $this->session->setRpToken($resetPasswordToken);
            $this->session->setRpCustomerId($customerId);
            $resultRedirect = $this->resultRedirectFactory->create();
            $resultRedirect->setPath('*/*/createpassword');

            return $resultRedirect;
        } else {
            /** @var Page $resultPage */
            $resultPage = $this->resultPageFactory->create();
            $resultPage->getLayout()
                       ->getBlock('resetPassword')
                       ->setResetPasswordLinkToken($resetPasswordToken)
                       ->setRpCustomerId($customerId);

            return $resultPage;
        }
    } catch (\Exception $exception) {
        $this->messageManager->addErrorMessage(__('Your password reset link has expired.'));
        /** @var Redirect $resultRedirect */
        $resultRedirect = $this->resultRedirectFactory->create();
        $resultRedirect->setPath('*/*/forgotpassword');

        return $resultRedirect;
    }
}

Answer 1

Simple steps to overcome this problem

1. Go to Admin dashboard
2. Click on Marketing -> Email Templates
3. Create new template by clicking on Add one Template

Template Name:

Forgot Admin Password(New)

Template Subject:

{{trans "Password Reset Confirmation for %name" name=$username}}

Template Content

{{trans "%name," name=$username}}

{{trans "There was recently a request to change the password for your account."}}

{{trans "If you requested this change, reset your password here:"}}

{{store url="admin/auth/resetpassword/" _query_id=$user.user_id _query_token=$user.rp_token _nosid=1}}

{{trans "If you did not make this request, you can ignore this email and your password will remain the same."}}

{{trans "Thank you,"}}

{{var store.frontend_name}}

Then go to Store -> Configuration -> Advanced -> Admin -> Admin User Emails

Change Forgot Password Email Template to newly created template

Forgot Admin Password(New)

Save and check

Answer 2

In my case I had to change my custom theme (porto) file: app/design/frontend/Smartwave/porto/Magento_Customer/templates/form/resetforgottenpassword.phtml

and introduce new form param id like following:

['id' => $block->getRpCustomerId(), 'token' => $block->getRequest()->getParam("token")]

Answer 3

magento 2.4.4 has changed email template variables, compare email templates from vendor module and make changes if you have override them

Answer 4

I had a similar issue after overriding the template in

Magento_Customer/templates/form/resetforgottenpassword.phtml

I just added a div-Container there and it caused the reset-password site to not execute properly. Removing the customized phtml solved the issue.

Answer 5

I get this issue with Magento 2.4.5-p1 I custom email template then the issue happens. The cause by email template. Reset email template to default email template content then it works.

Answer 6

Sometime it causes if eav_attribute table has no entry of related customer attributes. ie., rp_token, rp_token_created_at and password_hash.

Sometime password_hash no value in table occurs customer invalid password also.

If such issues are there. you can create rp_token, rp_token_created_at and password_hash values in eav_attribute for customer entity type.

Thank You!

Answer 7

I found these confusing to understand, so I figure I'd give explaining it a try. I got the answer from Ben up above, this post just adds explanation around the solution. Previous version of Magento only had a token in the url like this /customer/account/createPassword/?token=Ghtdfd3z2SomeToken3ffdf3nE but new versions of Magento now require the users entity_id in the url also, so that new url looks like this /customer/account/createPassword/?id=123&token=Ghtdfd3z2SomeToken3ffdf3nE

You would think that this should be resolved when upgrading Magento, but the email templates are stored as data in the database, so the data doesn't change.
Luckily, the solution is simple. In your email template, Admin->Marketing->Email Templates-> select the forgot password template. in that code, find this {{var this.getUrl($store,'customer/account/createPassword/',[_query:[token:$customer.rp_token],_nosid:1])}} and change it to this {{var this.getUrl($store,'customer/account/createPassword/',[_query:[id:$customer.id,token:$customer.rp_token],_nosid:1])}}

that is it.