You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
A forgotten password forces the user to create a new account or the admin to share a new password. There's no way for a user with a forgotten password to have a password unknown to the admin.
Describe the solution you'd like
The user contacts the admin for help. In the admin panel, the admin clicks to obtain a one-time account reset token. The token is provided to the user who uses it to authenticate and is prompted to set a new password.
Describe alternatives you've considered
Send a password reset email upon request to the account address, if it exists. The email contains a one-time password presented as a pastable token and a clickable hyperlink . The OTP is valid for a few minutes. This would work, but most people don't want to set up an SMTP account, and I reckon most open-webui instances do not represent such a large number of users that self-service is truly necessary. Though, this would serve those admins with many users.
Additional context
Account life cycle events present opportunities for external attacks and admin overreach. The privacy-oriented user will appreciate having the option to choose between optimizing for chat preservation or chat privacy. For example, the default option could be to destroy chats if the password is administratively reset, thereby removing a convenient vector for attack or admin snooping (but not all vectors).
The text was updated successfully, but these errors were encountered:
qrkourier
changed the title
smtp for password reset and future notifications channel
password reset token
May 3, 2024
tjbck
changed the title
password reset token
feat: one time password reset token
May 3, 2024
I overlooked a feature that solves this for me. The user can reset their password after admin sets it.
It would be better if the admin set pw was single use, forcing the user to choose a new secret immediately, avoiding the persistence of a shared (compromised) secret.
The self service email method would still be useful for larger instances with many users.
Is your feature request related to a problem? Please describe.
A forgotten password forces the user to create a new account or the admin to share a new password. There's no way for a user with a forgotten password to have a password unknown to the admin.
Describe the solution you'd like
The user contacts the admin for help. In the admin panel, the admin clicks to obtain a one-time account reset token. The token is provided to the user who uses it to authenticate and is prompted to set a new password.
Describe alternatives you've considered
Send a password reset email upon request to the account address, if it exists. The email contains a one-time password presented as a pastable token and a clickable hyperlink . The OTP is valid for a few minutes. This would work, but most people don't want to set up an SMTP account, and I reckon most open-webui instances do not represent such a large number of users that self-service is truly necessary. Though, this would serve those admins with many users.
Additional context
Account life cycle events present opportunities for external attacks and admin overreach. The privacy-oriented user will appreciate having the option to choose between optimizing for chat preservation or chat privacy. For example, the default option could be to destroy chats if the password is administratively reset, thereby removing a convenient vector for attack or admin snooping (but not all vectors).
The text was updated successfully, but these errors were encountered: