@@ -131,12 +131,17 @@ public AuthenticationController(
131
131
AuthorizationPolicies . BackOfficeAccess ) ] // Needed to enforce the principle set on the request, if one exists.
132
132
public IDictionary < string , object > GetPasswordConfig ( int userId )
133
133
{
134
+ if ( HttpContext . HasActivePasswordResetFlowSession ( userId ) )
135
+ {
136
+ return _passwordConfiguration . GetConfiguration ( ) ;
137
+ }
138
+
134
139
Attempt < int > currentUserId =
135
140
_backofficeSecurityAccessor . BackOfficeSecurity ? . GetUserId ( ) ?? Attempt < int > . Fail ( ) ;
136
- return _passwordConfiguration . GetConfiguration (
137
- currentUserId . Success
138
- ? currentUserId . Result != userId
139
- : true ) ;
141
+
142
+ return currentUserId . Success
143
+ ? _passwordConfiguration . GetConfiguration ( currentUserId . Result != userId )
144
+ : new Dictionary < string , object > ( ) ;
140
145
}
141
146
142
147
/// <summary>
@@ -417,6 +422,8 @@ public async Task<bool> IsAuthenticated()
417
422
[ Authorize ( Policy = AuthorizationPolicies . DenyLocalLoginIfConfigured ) ]
418
423
public async Task < ActionResult < UserDetail ? > > PostLogin ( LoginModel loginModel )
419
424
{
425
+ HttpContext . EndPasswordResetFlowSession ( ) ;
426
+
420
427
// Start a timed scope to ensure failed responses return is a consistent time
421
428
var loginDuration = Math . Max ( _loginDurationAverage ?? _securitySettings . UserDefaultFailedLoginDurationInMilliseconds , _securitySettings . UserMinimumFailedLoginDurationInMilliseconds ) ;
422
429
await using var timedScope = new TimedScope ( loginDuration , HttpContext . RequestAborted ) ;
@@ -490,6 +497,8 @@ public async Task<IActionResult> PostRequestPasswordReset(RequestPasswordResetMo
490
497
return BadRequest ( ) ;
491
498
}
492
499
500
+ HttpContext . EndPasswordResetFlowSession ( ) ;
501
+
493
502
BackOfficeIdentityUser ? identityUser = await _userManager . FindByEmailAsync ( model . Email ) ;
494
503
495
504
await Task . Delay ( RandomNumberGenerator . GetInt32 ( 400 , 2500 ) ) ; // To randomize response time preventing user enumeration
@@ -646,6 +655,8 @@ public async Task<IActionResult> PostSend2FACode([FromBody] string provider)
646
655
[ AllowAnonymous ]
647
656
public async Task < IActionResult > PostSetPassword ( SetPasswordModel model )
648
657
{
658
+ HttpContext . EndPasswordResetFlowSession ( ) ;
659
+
649
660
BackOfficeIdentityUser ? identityUser =
650
661
await _userManager . FindByIdAsync ( model . UserId . ToString ( CultureInfo . InvariantCulture ) ) ;
651
662
if ( identityUser is null )
0 commit comments