534459 - Can't reset password.

Status: RESOLVED FIXED

(Firefox :: Sync, defect)

Description

[aerobeing]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Build Identifier: Weave 1.0b3

When trying to reset password on the weave password reset web-page it says e-mail has been sent, but I receive none.
When trying to reset it through the reset password option in the preferences menu, it gives me an error "Account name not on record, maybe it was deleted? EWTF_NO_ACCOUNT". When trying to create an account with that name anew, it says it's already in use.
Username: aerobeing

Reproducible: Always

Comment 1

[Kévin]

I have the same problem. Here is what's in the log :

2009-12-17 11:45:03	Net.Resource         DEBUG	POST Length: 10
2009-12-17 11:45:05	Net.Resource         DEBUG	GET request for https://auth.services.mozilla.com/weave-password-reset
2009-12-17 11:45:05	Net.Resource         DEBUG	POST fail: 301

Comment 2

[Toby Elliott [:telliott]]

Hrm, this is new.

It looks like a client bug - that's not the URL that should be being posted to from the web client (it's the URL for the human interface). Ed, are we pointing at this from somewhere?

(The mail issue is separate. We'll look into the email address, but there are always spam filters to deal with)

Comment 3

[Mike Connor [:mconnor]]

Client points at https://services.mozilla.com/pw/forgot.php which 301s over to weave-password-reset.  I guess that's wrong!

What should the client point to?

Comment 4

[Ed Lee :Mardak]

I think we want to point to

https://auth.services.mozilla.com/weave-password-reset

Probably should update the 1/user and 1/misc paths to 1.0/user and 1.0/misc while we're at it.

Comment 5

[Toby Elliott [:telliott]]

If it's just pointing at a web page, that's fine (the actual address is the one in the log in comment 1). The log made it looks like it was actually making the request through the app, in which case, we have an actual API for doing that when we want to leverage it.

Comment 6

[Ed Lee :Mardak]

Oh. There's a recaptcha on that page, so just POSTing uid=<username> won't work anymore.

Comment 7

[Toby Elliott [:telliott]]

Yeah, security asked us to add one, to make dictionary attacks harder

Comment 8

[Ed Lee :Mardak]

http://hg.mozilla.org/labs/weave/rev/45d032224c8d
Update the preference to point to the new password reset page on auth.smc, and for now, just open it per mconnor's suggestion. 

I can't seem to find any bug mentioning the password reset API changed, so I can't mark it as blocking this one or refer to it in the code comment for the patch.