Page MenuHomePhabricator

Wikibase.Cloud login failure after resetting password
Closed, ResolvedPublic5 Estimated Story Points


Log in to Wikibase.Cloud fails for account registered using task-specific email (e.g. after filling out password reset. Password is supposed to be reset but users can somehow use old password to log in.

Steps to reproduce

  1. Create a new account using a task-specific email (the one with + in it) either on or
  2. Navigate to
  3. Enter the email address associated with your account (i.e. the account that received this email) and select the “Reset” button
  4. You will receive an email with a link that will allow you to set a new password
  5. Follow this link and enter a secure new password for your account
  6. Log in to your account using this new password

This issue was reported by 1 user.


  • Option 1: This user agrees to change his email
  • Option 2: Fix api to work with task-specific emails
  • Write test
  • Change user's email to what he initially wants

Event Timeline

I couldn't replicate the failure... I've also tried it on local and and so far they all worked.

So actually task-specific email addresses (one with + in it) caused the problem. Password resetting email was sent and new password was created but somehow I can still login with the old password and even create a new wiki.

"POST /user/resetPassword HTTP/1.1" 422 517 "http://www.wbaas.localhost/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ Safari/537.36"

The POST request send to the api to reset the password was 422: The request was well-formed but was unable to be followed due to semantic errors. That's why the old password is still usable due to the fact that the HTTP request to reset password didn't work.

@dang The user has agreed to change their email by excluding the +task part. Everything else remains the same.

Option 2: Fix api to work with task-specific emails

I would strongly prefer this option for anything other than a short-term fix. Many providers now allow "+" mail-addresses and we are going to have more of these in the future.

I'm trying to go with option 2.

conny-kawohl_WMDE added a subscriber: dang.
dang removed dang as the assignee of this task.Jul 15 2022, 2:57 PM

Tested and verified, works perfectly @dang

@Evelien_WMDE: The project tag got archived and this open task has no other active project tags. Could you please either add an active project tag so this task can be found, or update the task status? Thanks a lot!