How do I configure Forcing Password Reset?

[GMSantiago-Dev]

I would like to activate the new function of Password Reset On All Users, but it is not very clear to me how to do it.

Sorry, I'm still very new to this.

[datamweb]

Hello,
I wasn't PR when this feature was added to Shield, never checked it after the merge. You made me play a little!

At first I was confused myself, and I was going to make some changes, but I got ahead of myself! Now you can proceed as follows:

1. step
Set the following value in file App/Config/Auth.php.

public array $redirects = [
// ...
 'force_reset' => 'change-password',
];

2. step
Set the following value in file App/Config/Filters.php

    public array $globals = [
        'before' => [
        'force-reset' => ['except' => ['login*', 'register', 'auth/a/*', 'change-password', 'logout']],
        // 'session' => ['except' => ['login*', 'register', 'auth/a/*']],
        ],
        'after' => [
            'toolbar',
            // 'honeypot',
            // 'secureheaders',
        ],
    ];

3. step
In file App/Config/Routes.php, add the following:

// add forcing password reset routes
$routes->get('change-password', 'PasswordReset::index');
$routes->post('change-password', 'PasswordReset::index');

4. step
Create a view in path app/Views/change_password.php as follows:

<?= $this->extend(config('Auth')->views['layout']) ?>

<?= $this->section('title') ?><?= lang('Auth.changePassword') ?> <?= $this->endSection() ?>

<?= $this->section('main') ?>

<div class="container d-flex justify-content-center p-5">
    <div class="card col-12 col-md-5 shadow-sm">
        <div class="card-body">
            <h5 class="card-title mb-5"><?= lang('Auth.changePassword') ?></h5>

            <?php if (session('error') !== null) : ?>
                <div class="alert alert-danger" role="alert"><?= session('error') ?></div>
            <?php elseif (session('errors') !== null) : ?>
                <div class="alert alert-danger" role="alert">
                    <?php if (is_array(session('errors'))) : ?>
                        <?php foreach (session('errors') as $error) : ?>
                            <?= $error ?>
                            <br>
                        <?php endforeach ?>
                    <?php else : ?>
                        <?= session('errors') ?>
                    <?php endif ?>
                </div>
            <?php endif ?>

            <?php if (session('message') !== null) : ?>
                <div class="alert alert-success" role="alert"><?= session('message') ?></div>
            <?php endif ?>

            <form action="<?= url_to('change-password') ?>" method="post">
                <?= csrf_field() ?>

                <!-- Password -->
                <div class="mb-2">
                    <input type="password" class="form-control" name="password" inputmode="text" autocomplete="new-password" placeholder="<?= lang('Auth.password') ?>" required />
                </div>

                <!-- Password Confirm -->
                <div class="mb-2">
                    <input type="password" class="form-control" name="password_confirm" inputmode="text" autocomplete="new-password" placeholder="<?= lang('Auth.passwordConfirm') ?>" required />
                </div>
                <!-- Old Password -->
                <div class="mb-2">
                    <input type="password" class="form-control" name="old_password" inputmode="text" autocomplete="current-password" placeholder="<?= lang('Auth.OldPassword') ?>" required />
                </div>

                <p class="text-center"><?= lang('Auth.logout') ?> <a href="<?= url_to('logout') ?>"><?= lang('Auth.logout') ?></a></p>

                <div class="d-grid col-12 col-md-8 mx-auto m-3">
                    <button type="submit" class="btn btn-primary btn-block"><?= lang('Auth.changePassword') ?></button>
                </div>

            </form>
        </div>
    </div>
</div>

<?= $this->endSection() ?>

5. step
Create a controller as shown below in path app\Controllers\PasswordReset.

<?php
 declare(strict_types=1);  

namespace App\Controllers;

use App\Controllers\BaseController;
use CodeIgniter\Exceptions\PageNotFoundException;

class PasswordReset extends BaseController
{
    protected $helpers = ['setting', 'url', 'form'];


    public function index()
    {
        // block route change-password if see befor login
        if (! auth()->loggedIn()) {
            throw PageNotFoundException::forPageNotFound();
        }

        if (auth()->user()->requiresPasswordReset()) {
            if (! $this->request->is('post')) {
                return view('change_password');
            }

            if (! $this->validate($this->getValidationRules())) {
                return redirect()->back()->withInput()->with('errors', $this->validator->getErrors());
            }

            $result = auth()->check([
                'email'    => auth()->user()->email,
                'password' => $this->request->getPost('old_password'),
            ]);

            if (!$result->isOK()) {
                return redirect()->to(config('Auth')->forcePasswordResetRedirect())->withInput()->with('error', 'Auth.oldPasswordWrong');
            }

            // Success!

            $users = auth()->getProvider();

            $user = auth()->user()->fill([
                'password' => $this->request->getPost('password')
            ]);

            $users->save($user);

            // Remove force password reset flag
            auth()->user()->undoForcePasswordReset();

            // logout user and print login via new password
            auth()->logout();
            return redirect()->to(config('Auth')->logoutRedirect())
                ->with('message', lang('Auth.changePasswordSuccess'));

        }

        // if user login but NOT need requiresPasswordReset
        throw PageNotFoundException::forPageNotFound();

    }

    /**
     * Returns the rules that should be used for validation.
     *
     * @return array<string, array<string, array<string>|string>>
     * @phpstan-return array<string, array<string, string|list<string>>>
     */
    protected function getValidationRules(): array
    {
        return setting('Validation.changePassword') ?? [
            'password' => [
                'label' => 'Auth.password',
                'rules' => 'required|strong_password',
            ],
            'password_confirm' => [
                'label' => 'Auth.passwordConfirm',
                'rules' => 'required|matches[password]',
            ],
        ];
    }
}

6. step
Add the untranslated strings to your language file.

End, enjoy the Shield.

[GMSantiago-Dev]

Thanks @datamweb 😃

[mshannaq]

@datamweb is there any way to revoke any remember me tokens after doing that?

thanks

[datamweb]

Try the following way:

use CodeIgniter\Shield\Models\RememberModel;
// ...

$rememberModel = model(RememberModel::class);        
$user = auth()->user();

$rememberModel->purgeRememberTokens($user);

[datamweb]

A more appropriate way:

$user = auth()->user();
auth()->forget($user);

[mikeeyo23]

I'm getting the following error....

"force-reset" filter must have a matching alias defined.

[datamweb]

Hi,
Please update the Shield with the following command:

composer require codeigniter4/shield:dev-develop

[mikeeyo23]

Ooops, corrected. Thanks