fix(auth): allow password reset on self-hosted (remove IS_CLOUD gate on reset pages)#112
Merged
Conversation
Remove the IS_CLOUD guard in getServerSideProps of the reset-password and send-reset-password pages (and the now-unused IS_CLOUD import) so the password-reset flow works on self-hosted, not only on cloud. The reset email is already sent on-prem (emailAndPassword/sendResetPassword are not cloud-gated), but the page the link points to redirected to "/", making the flow a dead end. The token guard on /reset-password is kept and the token is validated server-side by better-auth. (cherry picked from commit ead9e9a)
# Conflicts: # apps/dokploy/pages/send-reset-password.tsx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the
!IS_CLOUDredirect ingetServerSidePropsofreset-password.tsxandsend-reset-password.tsx(plus the now-unusedIS_CLOUDimport), so the password-reset flow is reachable on self-hosted instances, not only on cloud. The reset email is already sent on-prem (sendResetPassword/emailAndPasswordare not cloud-gated); previously the emailed link landed on a page that redirected to/, making the flow a dead end.Ports Dokploy#4665 by @nizepart (closed unmerged upstream 2026-06-30)
Addresses Dokploy#4664 (verified below)
Security review
sendResetPassword->sendEmail);requestPasswordResetnever returns it to the browser, so making the page reachable does not expose a token./reset-passwordkeeps its token-presence guard (redirects to/when notokenquery param);resetPassword(better-auth) validates the token and its expiry server-side, so there is no open reset./send-reset-passwordis the existing public "enter email" form (requestPasswordReset), which does not disclose account existence.sendResetPassword(pre-existing behavior, unchanged by this PR); no token is exposed in that path.Verification
!IS_CLOUDgate in both reset pages (reset-password.tsx,send-reset-password.tsx), confirming the flow is a dead end on self-hosted.pnpm --filter=dokploy run typecheckpasses.