Help with our Signup/Register flow and big security flaws

nahmadi
Fri, 23 Jan 2026 10:59:22 +0000

nik.baleca:

My suggestion in order to prevent the users from resetting the password by themselves would be to deny access to users using a password-reset-post-challenge trigger whenever email_verified is false. Since you are creating the users, this should be by default false. The code for this would look like this:

Hi @nik.baleca - I have been following this discussion, but am in a tight spot. If I follow your suggestion, and create an action:

  exports.onExecutePostChallenge = async (event, api) => {
    console.log("[onExecutePostChallenge]: ", event);

    if(event.user.email_verified === false) {
      //Deny access to the user
      api.access.deny("Please reset your password through the invitation link");

      //Redirect to a custom error page informing the user
      api.redirect.sendUserTo("https://example.com/");
    }
  };

When user clicks on the link, it leads to invalid link auth0 link screen. Upon checking the logs, it seems to be error of type fcpr, with message Failed to complete password reset as client could not be identified. Any configured Actions will not execute. Please include client_id in the change password request..

Now Im very confused about this error. Im simply using this action, don’t have any other custom code.