Email Address Validation for Forgot Password

Issue

• The Forgot Password option does not validate if the user enters a correct email address. You can enter anything and the field will accept it.
• Two types of validation are expected:
  1. Email format validation (to ensure the entered email address follows a valid format).
  2. Existing email validation (to verify that the entered email address is registered in the system).

 

Environment

• Quarterly Releases

 

Resolution

• Email format validation is not included in the Forgot Password functionality out-of-the-box. However, it is possible to customize this process and create an email address validator service. For guidance on how to achieve this, refer to this forum thread: Customize the email validation. Please note that Liferay Support does not provide assistance for implementing customization and you may seek help from our Global Services team.
• Existing email validation is intentionally not included in the Forgot Password process by default to prevent enumeration attacks. The property login.secure.forgot.password controls this behavior and is set to true by default. For more information, see How to prevent user enumeration attacks through the Forgot Password functionality.