Support the ongoing development of Laravel.io →
Security Forms

This issue is with respect to the password reset view (i.e., the view the user is sent to from the password reset email). The link in the email is a secure route (i.e., https://my.website.com/password/reset/tokenvalue ) and I was having trouble getting the Form submit route to also be secure.

Here's my form open code in my password reset view:

{{ Form::open(array('route' => array('password.update', $token))) }}

And my routes file with the password reset routes:

Route::get('password/reset/{token}', array(
 'uses' => 'PasswordController@reset',
 'as' => 'password.reset'
 ));

Route::post('password/reset/{token}', array(
 'https',
 'uses' => 'PasswordController@update',
 'as' => 'password.update'
 ));

And the controller update function:

public function update()
 {
 	$credentials = Input::only(
   'email', 'password', 'password_confirmation', 'token'
 	);

 	$response = Password::reset($credentials, function($user, $password)
 	{
   $user->password = Hash::make($password);

   $user->save();
 	});

 	switch ($response)
 	{
   case Password::INVALID_PASSWORD:
   case Password::INVALID_TOKEN:
   case Password::INVALID_USER:
    return Redirect::back()->withInput()->with('error', Lang::get($response));

   case Password::PASSWORD_RESET:
    return Redirect::back()->with('success', Lang::get($response));
 	}
 }

The way I got the URL in the password reset email to be secure is:

{{ URL::to('password/reset', array($token), true) }}

The password reset view loads securely, but once I hit submit I get a MethodNotAllowedHttpException.

I looked at the source of the page, and the form tag looks correct:

<form method="POST" action="https://my.website.com/password/reset/2d514a969c5faab28ad87c31b78dce0727f5aa2a" accept-charset="UTF-8"><input name="_token" type="hidden" value="NtR6jpmE2YJmayV4rsVAeaAspuXLq63fQofQylkd">

I was able to come up with a workaround, and my password reset view form open code looks like this:

{{ Form::open(array('url' => 'https://my.website.com/password/reset/'.$token)) }}

I also removed the 'https' option from the update route.

This workaround works without any issues, but it doesn't seem like the best way to do it.

I'm running my app on AWS Elastic Beanstalk with an SSL certificate on the load balancer. So data is secure between the web and the load balancer, but past the load balancer it's within my VPC and it's unencrypted. I'm not sure if that has anything to do with it.

Any guidance on what may be going wrong here? Thanks!

Last updated 3 years ago.
0

Sign in to participate in this thread!

Eventy

Your banner here too?

pauly4it pauly4it Joined 6 Jun 2014

Moderators

We'd like to thank these amazing companies for supporting us

Your logo here?

Laravel.io

The Laravel portal for problem solving, knowledge sharing and community building.

© 2025 Laravel.io - All rights reserved.