Problem/Motivation

The end user experience when needing to reset a password is confusing.

Steps to reproduce

  • User lands on a page that is not the homepage, but needs to then login.
  • User clicks a Login link. A destination parameter on the login link serves to return them to their place after login.
  • However, the user forgets their password so clicks "Reset your Password" tab from Login page.
  • Destination parameter is lost.
  • User submits the password reset form and is redirected to the homepage, completely out of their browsing context.
  • The password reset confirmation message feels out of place on the homepage and may be lost in a sea of unrelated marketing content.
  • The one-time login link sent by email does not contain the original destination parameter, because it was lost from the URL context by the time they got to the password reset form in a previous step above.

Proposed resolution

  1. Preserve the destination parameter from URL to the "Reset Your Password" tab/link, particularly from the "Login" page.
  2. Pass along the destination parameter inside the one-time password login links sent by email to drop people back into the context they were in when they requested the login form and instead had to go reset their password.
  3. If no destination parameter is present, change the current redirect behavior to reload the current /user/password page instead of redirecting to the homepage.
  4. Add a way to change the default fallback redirect destination for password reset, instead of hardcoding an opinionated redirect destination and intercepting it via a form alter and submit handler as suggested in #3 and #9.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Original report by @prathamesh.save

How can I redirect some users after they reset their password? Specifically when user receives their password reset link, once they update their password after that they should be redirect to other pages. Simple login redirection can be done using hook_user_login(). But this wont work with user password reset.

Example: Redirect specific users based on their tags to some specific pages like:
user 1 will redirect to homepage-1
user 2 will redirect to homepage-2

Comments

prathamesh.save created an issue. See original summary.

cilefen’s picture

Issue tags: -password reset
shailja179’s picture

Assigned: Unassigned » shailja179
Status: Active » Needs review

@prathamesh.save,
You can try something like below code to achieve this.

function hook_form_user_pass_alter(&$form, &$form_state) {
    $form['#submit'][] = 'custom_password_redirect';
 }
/**
* Redirects user after password reset form is filled.
*/
function custom_password_redirect(&$form, &$form_state){
  $form_state['redirect'] = 'node/20';
}
shailja179’s picture

Assigned: shailja179 » Unassigned
smustgrave’s picture

Status: Needs review » Postponed (maintainer needs more info)

@prathamesh.save this answer your question?

prathamesh.save’s picture

Thanks @shailja179 in normal behavior it worked.

@smustgrave yes, I got the answer thanks.

smustgrave’s picture

Status: Postponed (maintainer needs more info) » Closed (works as designed)

Awesome!

jwilson3’s picture

Category: Support request » Feature request
Status: Closed (works as designed) » Active

I'm reopening this and classifying it as a feature request.

It does seem less than ideal that Drupal redirects the user to the homepage (and thus completely out of a user's login workflow and context).
More often than not, the homepage is filled with designy marketing blocks and highlighted regions. Occasionally these highlight/feature/hero theme regions can bump the system messages down below the fold. Long story short, the little password reset message can easily get lost in a sea of other more important content on the homepage.

The little password reset message:

If admin@example.com is a valid account, an email will be sent with instructions to reset your password.

This message feels totally out of place on a website's homepage.

On the other hand, the /user/login or /user/password page are typically fairly sparse aside from the form. On these pages the password reset message is not only relevant, but will be impossible to miss.

What Drupal *could* do to improve the UX on password reset:

  1. Curiously if you add a ?destination URL parameter, then you can redirect wherever you like. The hard part is getting the destination parameter added to the URL. Eg /user/password?destination=/user/password will effectively keep you on the same page when you submit the form. What we could do here is preserve the destination parameter from the /user/login page by adding the destination parameter to the "Reset Your Password" tab. We could also pass along the destination parameter inside the one-time password login links sent by email to drop people back into the context they were in when they requested the login form, and had to go to the password reset form insetad.
  2. Change current behavior to fallback to redirecting to either/user/login or just reload the current /user/password page.
  3. Add a $setting['password_redirect_url'] to allow intrepid users to override the default fallback redirect for password reset in settings.php.
  4. Optionally, ff we decide that the default fallback redirect is to stay on /user/password then we could consider hiding the form and just show the message.
jwilson3’s picture

To get #3 working on Drupal 9/10+ try this:

/**
 * Implements hook_form_FORM_ID_alter() for the password reset form.
 */
function YOUR_MODULE_form_user_pass_alter(&$form, &$form_state) {
  $form['#submit'][] = 'YOUR_MODULE_custom_password_redirect';
}

/**
 * Overrides default redirect behavior on form submit of password reset.
 */
function YOUR_MODULE_custom_password_redirect(&$form, &$form_state) {
  // Redirect to node/20
  $form_state->setRedirect('entity.node.canonical', ['node' => 20]);

  // Don't redirect; reload the password reset page.
  $form_state->setRedirect('user.pass');
}
jwilson3’s picture

Title: Redirect user after password reset » Improve redirect UX for password reset and login workflow
Issue summary: View changes
jwilson3’s picture

Version: 9.5.x-dev » 11.x-dev
jwilson3’s picture

Issue summary: View changes
hockey2112’s picture

#9 worked great, thanks!

anybody’s picture

Title: Improve redirect UX for password reset and login workflow » Preserve destination parameter across password reset worklow

Updating the title to be more specifc. Hope this one matches.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.