Ability to update a password without using magic l...
# ideas-and-suggestionse
erik_flywheel
09/13/2021, 6:11 PMAbility to update a password without using magic link & password reset email. Here are a few use cases:
1. Our mobile app doesn't have deep links, so we can't extract the user's auth token in the redirect URL.
2. Using a custom change password email from a registered email address
3. Building a custom change password process into an app that doesn't require email
s
silentworks
09/14/2021, 4:28 PM@User and @User move your conversations here please
k
Kylar
09/14/2021, 4:34 PMI don't think an auth provider should give the developers the ability to reset my password without me having a say in it, and that's exactly what an endpoint without sms/email would do
Kylar
09/14/2021, 4:36 PM+ making that call from a frontend sdk? everything client-side is vulnerable, thats why supabase relies on database RLS for the data
e
erik_flywheel
09/14/2021, 4:38 PMI'd give the developer the discretion. I dont think the platform should prevent developers from building applications the way they want...
erik_flywheel
09/14/2021, 4:39 PMThe real issue for this is that I can't actually use the email auth because we don't have a way to redirect the URL for our mobile app
erik_flywheel
09/14/2021, 4:39 PMWe want to build our own process of emailing the user an OTP, not a redirect. but can't update the user (I think?) without the bearer token
k
Kylar
09/14/2021, 4:45 PMOnce they have functions, they can have an admin sdk with full permissions for stufff like this, but they absolutely cannot enable that from a client sdk imo
Kylar
09/14/2021, 4:45 PMI'd investigate into catching the links with something like https://firebase.google.com/docs/dynamic-links. It's easy to implement and (I think) completely free
e
erik_flywheel
09/14/2021, 4:46 PMlet me check this out
k
Kylar
09/14/2021, 4:47 PMmaybe this helps too https://www.raywenderlich.com/6080-universal-links-make-the-connection
s
silentworks
09/14/2021, 4:48 PMI actually don't think its a bad idea to have a function to updatePassword from the client, Firebase does this and I think it would be good if Supabase allowed this too. I'm sure there are security measures they can take to make sure it isn't abused.
e
erik_flywheel
09/14/2021, 4:48 PMYeah, I dont think this works for us. We're building apps using Adalo which doesn't support deep links
s
silentworks
09/14/2021, 4:48 PMHere is firebase's example https://firebase.google.com/docs/auth/web/manage-users#set_a_users_password
e
erik_flywheel
09/14/2021, 4:48 PMin order to do anything with a URL, we'll have to build a web app just for that purpose...
k
Kylar
09/14/2021, 4:49 PMFirebase does do it but requires recent auth, and therefore doesn't work as a "recover password"
e
erik_flywheel
09/14/2021, 4:49 PMIf there was an OTP email reset that would be ideal - trigger the reset, it updates the user's password to the OTP, supabase emails the user the OTP, send the user to a form to reset the OTP
k
Kylar
09/14/2021, 4:49 PMFor recovering pwd, you'd still need email
s
silentworks
09/14/2021, 4:50 PM@User that is true, I think it would be good to have it work exactly the same as firebase's does.
silentworks
09/14/2021, 4:51 PMRight now there is no way to change the password without using a reset password email even if the user is logged in.
silentworks
09/14/2021, 4:51 PMThis is where I would like to see this feature working.
k
Kylar
09/14/2021, 4:54 PMFor how Erik was presenting the issue, I had in mind the "recover password" flow, not simply updating it
Kylar
09/14/2021, 4:55 PMYou do have a point in allowing an "edit password" with your custom UI, i'd just have these security considerations in mind
s
silentworks
09/14/2021, 4:55 PMI followed his thread on twitter and I would like to think he is after what I mentioned, but @User can verify this himself if this is not the case.
k
Kylar
09/14/2021, 4:56 PMYeah I'm re-reading now and I did assume a recover pwd flow after he mentioned the security questions in order to verify id.
I would be on board for a client-based "edit password"
e
erik_flywheel
09/14/2021, 4:57 PMFor password reset or update we would need some process that doesn't involve a URL redirect. My current problem is more reset. if you need to update it I can always push a user to just reset. If you need to reset, I cant push you to update
erik_flywheel
09/14/2021, 4:58 PMI can't use the magic link or password recovery built in, so for users who lose their passwords, right now they'll have to delete the account and sign up again...
erik_flywheel
09/14/2021, 4:59 PMI'd be happy to do an OTP email reset. If supa didn't want to provide a direct update user password api call. If I could update the user password via api, I would build my own verification process with an OTP, verify them, then have them choose a new password and update the user
erik_flywheel
09/14/2021, 5:00 PMfor reference, we're not using any javascript. we're 100% postgrest api calls using the bash functions