`dbAuth` Forgot Password -- Case-Insensitive Option?

ahoopes16 · November 26, 2023, 10:01pm

Hey there,

I’ve got an application using the dbAuth built-in forgotPassword functionality, and for the most part it works great! I was wondering if there was an option for the username matching to be case-insensitive, like there is for the login and signUp features? If there is, I haven’t been able to find anything about it in the documentation. It would be greatly appreciated if it isn’t a feature today. Thanks!

arimendelow · November 29, 2023, 4:29pm

Hi!

I actually haven’t used the forgotPassword flow at all yet, but my understanding is that username case-insensitivity is a database concern: Case sensitivity (Reference)

Have you tested and verified its case sensitivity?

ahoopes16 · November 29, 2023, 4:40pm

Thanks for responding @arimendelow!

Yes, I have verified that it is case-sensitive. A user of mine ran into this issue so I started looking into it to see if there was a case-insensitive option like there is for login and signUp.

It’s not hugely important either way – I think it’s pretty weird of that user to sign up with their email cased one way and then try to reset their password with it cased another way. But my client was asking for it and since it is a configuration option for the other 2 features, I was expecting it to be there for forgotPassword as well.

arimendelow · November 29, 2023, 11:36pm

Ah I see - if you want to open a PR for making this change, you’ll want to do it here:

github.com

redwoodjs/redwood/blob/8f0e3f9b1fa7f9354cfbe09e9dc93944d9f6eec5/packages/auth-providers/dbAuth/api/src/DbAuthHandler.ts#L504C65-L504C65


      
          where: { [this.options.authFields.username]: username },

Rather than a simple where, you’ll want to do this:

github.com

redwoodjs/redwood/blob/8f0e3f9b1fa7f9354cfbe09e9dc93944d9f6eec5/packages/auth-providers/dbAuth/api/src/DbAuthHandler.ts#L1268C1-L1276C9


      
          const findUniqueUserMatchCriteriaOptions =
            this._getUserMatchCriteriaOptions(username, usernameMatchFlowOption)
          let user
          
          try {
            // does user exist?
            user = await this.dbAccessor.findFirst({
              where: findUniqueUserMatchCriteriaOptions,
            })

More info on per-database case-sensitivity here: Self-hosted Authentication (dbAuth) | RedwoodJS Docs

ahoopes16 · December 3, 2023, 6:42pm

Sounds great, thank you for the context!