Customer reset password issue

[devprimari14dd]

Hi, I have upgraded my magento store from 2.3.6 to 2.3.7-p4 and when I try to reset my customer password, I receive the link via email but when I submit the new password it always shows the error Your password reset link has expired.
I checked the database and the column rp_token_created_at is being updated every time I refresh on the reset password page, so I think that the problem might be related.

Thank you in advance.

[zoyascootg16c3]

Based on the information you provided, it seems that the issue is related to the expiration time of the password reset link.

The rp_token_created_at column in the database is responsible for tracking when the password reset token was created. The token is usually set to expire after a certain period of time, which is set in the Magento configuration.

To resolve this issue, you can try adjusting the token expiration time in the Magento configuration. Here are the steps to follow:

1. Log in to the Magento Admin panel.
2. Navigate to Stores > Configuration.
3. Click on the Customers tab and select the Password Options sub-tab.
4. Under the Password Reset Link Expiration field, adjust the time limit to a longer duration.
5. Save the changes and test the password reset functionality again.

If the issue persists, you may want to check the Magento logs for any relevant error messages. Additionally, you can try clearing the Magento cache and resetting the password again.

I hope this helps!

[devprimari14dd]

Hi, I tried that and set the expiration time to 24 hours and when I tried to reset the password again the same thing happen.
I've checked the log files and nothing shows there and i noticed that the column rp_token_created_at is being updated after I submit the reset password form.

[devprimari14dd · Accepted solution]

Hi, the problem was on the override of the file resetforgottenpassword.phtml on my custom template that didn't have the param id on the form which was causing the problems, after i had this param i could reset the password without problems.
So far this was the only problem found related to the upgrade. I've checked the release notes from versions between 2.3.6 to 2.3.7-p4 and didn't see documention about any change to this form, only to the create account form.

Best regards and thank you for the help.

[Milople · Accepted solution]

Hello @devprimari14dd,

The issue you're encountering with the password reset link may indeed be related to the rp_token_created_at column in the database. Here are some steps you can take to troubleshoot and potentially resolve the issue:

Verify Server Time Ensure that the server time is correctly configured and matches the timezone set in Magento. A discrepancy in server time could cause the reset link to appear expired even though it's still valid.

Check Token Expiry Configuration. In Magento 2.3.7-p4, the token expiration time for password reset links is configurable. You can check the current configuration in the Admin Panel under Stores > Configuration > Customers > Customer Configuration > Password Options. Make sure the "Recovery Link Expiration Period" is set to a reasonable value, such as 24 hours.

If issue still persist then it is version issue please upgrade your magento to latest version and all the issues will be resolved.

If you have any questions, feel free to contact us.