CODEWITHSUNDEEP
next.jssupabasereset-password
lodey
lodey

Reputation: 304

Supabase Reset Password Token

In Supabase, when a user requests a password reset, they receive a reset token via email. Clicking the reset link takes them to the reset password page, which includes the token in the URL. Alternatively, someone could manually enter a URL like domain/reset-password?random-token, which would also load the reset page.

Reset Password Flow:

  1. The user requests a password reset.
  2. They receive an email with a reset link.
  3. Clicking the link redirects them to the reset password page with a token in the URL.
  4. The token is sent to Supabase to validate and update the password.

Issue: If someone enters an invalid or random token in the URL, they still land on the reset password page. I want to prevent this and instead redirect them to the login page if the token is invalid.

Solution: How can I handle this validation properly? Is there a way to check the token before rendering the reset page and redirect users if the token is invalid?

Upvotes: 1

Views: 104

Answers (1)

Swargaraj Bhowmik
Swargaraj Bhowmik

Reputation: 43

Supabase provides a built-in way to handle password reset token validation using the verifyOtp method.

Validate the Reset Token

const { data, error } = await supabase.auth.verifyOtp({
  token: token,
  type: 'recovery'
});

Reference:

Supabase Docs: https://supabase.com/docs/reference/javascript/auth-verifyotp

Upvotes: 1

Related Questions