pocketbase / js-sdk

PocketBase JavaScript SDK

Home Page:https://www.npmjs.com/package/pocketbase

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

requestPasswordReset is true, but doesn't send reset email.

alef0gli opened this issue · comments

commented

$lib/pocketbase.js

import PocketBase from 'pocketbase';

export const pb = new PocketBase("http://127.0.0.1:8090");

+page.server.js

import { pb } from '$lib/pocketbase';

/** @type {import('./$types').Actions} */
export const actions = {
	reset: async () => {
		let email = 'test@example.com';
		let reset = await pb.collection('users').requestPasswordReset(email);
		console.log(reset);
	}
};

Expected Behavior:
When requestPasswordReset is called with a valid email address, it should send a password reset email to the specified user. The email should contain instructions on how to reset the password.

Actual Behavior:
When requestPasswordReset is called with a valid email address, no reset email is being sent and the console log prints reset = true

This is intentional to avoid user enumerations.
The request password will always return a success response no matter whether a user with the specified email exists or the email was successfully sent.

Additionally, internally we also have a very rudimentary flood protection that will skip the email sending if the previous email was sent < ~2 minutes.

For more detailed errors you can start the PocketBase executable with --debug and/or check the request logs in the Admin UI > Logs.

Also note that by default PocketBase uses the unix sendmail command (if available) which is not very reliable and it is recommend to enable the SMTP setting when sending emails.

You can also test the email send functionality from the Admin UI > Settings > Mail settings.

For a test SMTP server I often use mailtrap.io (they have free option and doesn't require providing billing details).