Magento 2.4.4. password reset link always expired

Question

After updating to Magento 2.4.4, clicking the "Set new password" link in the "Forgot password mail" send by the system the link always shows as expired?!

Setting of "Recovery Link Expiration Period (hours) = 2 hours"

Seems like a bug to me. Does anyone see what is wrong in native Magento CreatePassword.php for example? Replacing "token" with "amp;token" does not help (as suggested by some for earlier versions)

CreatePassword.php in vendor/magento/module-customer/Controller/Account is as follows in Magento 2.4.4:

  public function __construct(
    Context $context,
    Session $customerSession,
    PageFactory $resultPageFactory,
    AccountManagementInterface $accountManagement,
    ConfirmCustomerByToken $confirmByToken = null,
    GetCustomerByToken $getByToken = null,
    CustomerRepositoryInterface $customerRepository = null
) {
    $this->session = $customerSession;
    $this->resultPageFactory = $resultPageFactory;
    $this->accountManagement = $accountManagement;
    $this->confirmByToken = $confirmByToken
        ?? ObjectManager::getInstance()->get(ConfirmCustomerByToken::class);
    $this->getByToken = $getByToken
        ?? ObjectManager::getInstance()->get(GetCustomerByToken::class);
    $this->customerRepository = $customerRepository
        ?? ObjectManager::getInstance()->get(CustomerRepositoryInterface::class);

    parent::__construct($context);
}

/**
 * Resetting password handler
 *
 * @return Redirect|Page
 */
public function execute()
{
    $resetPasswordToken = (string)$this->getRequest()->getParam('token');
    $customerId = (int)$this->getRequest()->getParam('id');
    $isDirectLink = $resetPasswordToken != '';
    if (!$isDirectLink) {
        $resetPasswordToken = (string)$this->session->getRpToken();
        $customerId = (int)$this->session->getRpCustomerId();
    }

    try {
        $this->accountManagement->validateResetPasswordLinkToken($customerId, $resetPasswordToken);
        $this->confirmByToken->resetCustomerConfirmation($customerId);

        // Extend token validity to avoid expiration while this form is
        // being completed by the user.
        $customer = $this->customerRepository->getById($customerId);
        $this->accountManagement->changeResetPasswordLinkToken($customer, $resetPasswordToken);

        if ($isDirectLink) {
            $this->session->setRpToken($resetPasswordToken);
            $this->session->setRpCustomerId($customerId);
            $resultRedirect = $this->resultRedirectFactory->create();
            $resultRedirect->setPath('*/*/createpassword');

            return $resultRedirect;
        } else {
            /** @var Page $resultPage */
            $resultPage = $this->resultPageFactory->create();
            $resultPage->getLayout()
                       ->getBlock('resetPassword')
                       ->setResetPasswordLinkToken($resetPasswordToken)
                       ->setRpCustomerId($customerId);

            return $resultPage;
        }
    } catch (\Exception $exception) {
        $this->messageManager->addErrorMessage(__('Your password reset link has expired.'));
        /** @var Redirect $resultRedirect */
        $resultRedirect = $this->resultRedirectFactory->create();
        $resultRedirect->setPath('*/*/forgotpassword');

        return $resultRedirect;
    }
}

Answer 1

Simple steps to overcome this problem

1. Go to Admin dashboard
2. Click on Marketing -> Email Templates
3. Create new template by clicking on Add one Template

Template Name:

Forgot Admin Password(New)

Template Subject:

{{trans "Password Reset Confirmation for %name" name=$username}}

Template Content

{{trans "%name," name=$username}}

{{trans "There was recently a request to change the password for your account."}}

{{trans "If you requested this change, reset your password here:"}}

{{store url="admin/auth/resetpassword/" _query_id=$user.user_id _query_token=$user.rp_token _nosid=1}}

{{trans "If you did not make this request, you can ignore this email and your password will remain the same."}}

{{trans "Thank you,"}}

{{var store.frontend_name}}

Then go to Store -> Configuration -> Advanced -> Admin -> Admin User Emails

Change Forgot Password Email Template to newly created template

Forgot Admin Password(New)

Save and check

Answer 2

In my case I had to change my custom theme (porto) file: app/design/frontend/Smartwave/porto/Magento_Customer/templates/form/resetforgottenpassword.phtml

and introduce new form param id like following:

['id' => $block->getRpCustomerId(), 'token' => $block->getRequest()->getParam("token")]

Answer 3

magento 2.4.4 has changed email template variables, compare email templates from vendor module and make changes if you have override them

Answer 4

I had a similar issue after overriding the template in

Magento_Customer/templates/form/resetforgottenpassword.phtml

I just added a div-Container there and it caused the reset-password site to not execute properly. Removing the customized phtml solved the issue.

Answer 5

I get this issue with Magento 2.4.5-p1 I custom email template then the issue happens. The cause by email template. Reset email template to default email template content then it works.

Answer 6

My issue was in my custom the (Porto) like @Maciej Lemiesz wrote