This issue is with respect to the password reset view (i.e., the view the user is sent to from the password reset email). The link in the email is a secure route (i.e., https://my.website.com/password/reset/tokenvalue ) and I was having trouble getting the Form submit route to also be secure.
Here's my form open code in my password reset view:
{{ Form::open(array('route' => array('password.update', $token))) }}
And my routes file with the password reset routes:
Route::get('password/reset/{token}', array(
'uses' => 'PasswordController@reset',
'as' => 'password.reset'
));
Route::post('password/reset/{token}', array(
'https',
'uses' => 'PasswordController@update',
'as' => 'password.update'
));
And the controller update function:
public function update()
{
$credentials = Input::only(
'email', 'password', 'password_confirmation', 'token'
);
$response = Password::reset($credentials, function($user, $password)
{
$user->password = Hash::make($password);
$user->save();
});
switch ($response)
{
case Password::INVALID_PASSWORD:
case Password::INVALID_TOKEN:
case Password::INVALID_USER:
return Redirect::back()->withInput()->with('error', Lang::get($response));
case Password::PASSWORD_RESET:
return Redirect::back()->with('success', Lang::get($response));
}
}
The way I got the URL in the password reset email to be secure is:
{{ URL::to('password/reset', array($token), true) }}
The password reset view loads securely, but once I hit submit I get a MethodNotAllowedHttpException.
I looked at the source of the page, and the form tag looks correct:
<form method="POST" action="https://my.website.com/password/reset/2d514a969c5faab28ad87c31b78dce0727f5aa2a" accept-charset="UTF-8"><input name="_token" type="hidden" value="NtR6jpmE2YJmayV4rsVAeaAspuXLq63fQofQylkd">
I was able to come up with a workaround, and my password reset view form open code looks like this:
{{ Form::open(array('url' => 'https://my.website.com/password/reset/'.$token)) }}
I also removed the 'https' option from the update route.
This workaround works without any issues, but it doesn't seem like the best way to do it.
I'm running my app on AWS Elastic Beanstalk with an SSL certificate on the load balancer. So data is secure between the web and the load balancer, but past the load balancer it's within my VPC and it's unencrypted. I'm not sure if that has anything to do with it.
Any guidance on what may be going wrong here? Thanks!
Sign in to participate in this thread!
The Laravel portal for problem solving, knowledge sharing and community building.
The community