How to manually generate reset password token (for use in React Native app)

faceyspacey · April 29, 2016, 4:54am

I’m looking to generate this token myself rather than have Meteor automatically generate it in the reset password email. My goal is so user’s don’t have to leave the app. My plan is just to send the token directly to the client application, and then let them use the token to reset the password using Accounts.resetPassword(token, newPassword).

I’m already confirming their ownership of the email manually myself with a generated a 5 digit code I email them, which they can see as a push notification generated by their email app and enter within the app without ever having to go check their email and click a link, which is what I’m trying to avoid since it’s annoying to the user.

Also note: it’s not that I’m trying to avoid the development work of implementing iOS Universal Links to have the app intercept the URL and then parse the token out of it when the webpage automatically redirects back to the app–though avoiding that mess is a win as well.

So what’s the code used on the server to generate the reset password token? And perhaps is there a way to call it from the client while blocking the delivery of the corresponding email?

hwillson · April 29, 2016, 6:32pm

The token is generated on the server by the accounts-password package, in Accounts.sendResetPasswordEmail:

github.com

meteor/meteor/blob/49c9d07be833561a789f57581416638bca4d249d/packages/accounts-password/password_server.js#L541-L554


var token = Random.secret();
var when = new Date();
var tokenRecord = {
  token: token,
  email: email,
  when: when
};
Meteor.users.update(userId, {$set: {
  "services.password.reset": tokenRecord
}});
// before passing to template, update user object with new token
Meteor._ensure(user, 'services', 'password').reset = tokenRecord;


var resetPasswordUrl = Accounts.urls.resetPassword(token);

Currently the token generation and emailing are both handled in the same function, so you’ll want to override this (maybe look into generating the token yourself and adding it to the users collection under services.password.reset).

hemalr87 · July 26, 2017, 10:50am

Did you end up getting this working?

I’m looking to do something similar because I want to send a specific email template (not coded within my app but using a template made on Mailjet). I can’t see any way to do that other than generating the token myself and passing it to Mailjet…