Inconsistent Password Reset Redirect Between 8.6.3 and 9.4.0-alpha.2

[rjcodedev]

New Issue Checklist

• Report security issues confidentially.
• Any contribution is under this license.
• Before posting search existing issues.

Issue Description

In version 8.6.3, the Request Password Reset page redirects to choose_password.html, which is properly styled with CSS.
However, in version 9.4.0-alpha.2, the Request Password Reset page redirects to password_reset.html. This page does not have any CSS applied because it has not been designed yet, resulting in an unstyled appearance.

I see two possible solutions:

1. Update the routing so that the Request Password Reset page redirects to choose_password.html instead of password_reset.html.
2. Copy the CSS from the choose_password.html file and apply it to password_reset.html to ensure consistent styling.

Steps to reproduce

1. Call await Parse.User.requestPasswordReset(username);
2. Click the Verify Email button in the email received.
   In version 8.6.3, this action redirects the user to:
   http://localhost:8080/app/apps/choose_password?token=IJmP6qtmURmucQxIYd2bPi43c&id=product&app=Product%E2%84%A2
   However, when calling the same method in version 9.4.0-alpha.2, the user is redirected to: http://localhost:8080/app/apps/product/request_password_reset?token=IJmP6qtmURmucQxIYd2bPi43c

[parse-github-assistant]

🚀 Thanks for opening this issue!

ℹ️ You can help us to fix this issue faster by opening a pull request with a failing test. See our Contribution Guide for how to make a pull request, or read our New Contributor's Guide if this is your first time contributing.

[mtrezza]

This page does not have any CSS applied because it has not been designed yet

I don't understand what the bug is?

[rjcodedev]

In version 8.6.3, the Reset Password page displays with CSS styling applied.

However, when following the same steps in version 9.4.0-alpha.2, the Reset Password page loads without any CSS styling.

Note:
In version 8.6.3, I did not add any pages configuration.
In version 9.4.0-alpha.2, I enabled pages.encodePageParamHeaders: true

[mtrezza]

@coderabbitai please inquire with @rjcodedev to clarify the exact issue that should be fixed. The 2 main unclear points I found are:

1. Where in the codebase is the CSS styling that should be applied? If there is no CSS styling, then it would be a feature request to add it, given that the HTML pages are just explanatory templates.
2. How does CSS styling relate to the PR title "Inconsistent Password Reset Redirect"?

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for password reset related HTML files and templates
fd -e html -e ejs -e hbs | grep -i "password\|reset" | head -20

# Search for password reset page definitions in the codebase
rg -l "password.*reset" --type-add 'web:*.{html,ejs,hbs}' --type web | head -10

# Look for page templates in common locations
fd -t f "password" src/ --exec echo "File: {}" \; --exec head -20 {} \; 2>/dev/null | head -100

# Search for CSS files in the repository
fd -e css | head -20

Length of output: 1039

---

🏁 Script executed:

#!/bin/bash
# Look at the actual password reset HTML files to see if they have CSS
echo "=== Checking public/password_reset.html ==="
cat public/password_reset.html

echo -e "\n=== Checking public/password_reset_success.html ==="
cat public/password_reset_success.html

# Search for pages configuration in the codebase
echo -e "\n=== Searching for pages configuration ==="
rg "encodePageParamHeaders" -A 5 -B 5 | head -50

# Search for where these HTML templates are served
echo -e "\n=== Searching for password reset route handlers ==="
rg "password_reset\.html" -n -C 3 | head -50

Length of output: 11116

---

@mtrezza Based on my search of the codebase, I found that the default password reset HTML files (public/password_reset.html, public/password_reset_success.html) contain no CSS styling at all - they are basic HTML templates as you noted.

@rjcodedev To help clarify this issue, could you please provide more details:

1. Custom Pages Configuration: In version 8.6.3, were you using custom password reset pages via the pages.customUrls.passwordReset configuration option, or were you using the default Parse Server templates? If custom, what was the URL you configured?

2. CSS Source in v8.6.3: Where was the CSS styling coming from in version 8.6.3?

   • Was it embedded in custom HTML files you provided?
   • Was it linked from an external stylesheet?
   • Can you share the HTML/CSS that was working in v8.6.3?

3. Configuration Differences: Besides enabling pages.encodePageParamHeaders: true, did you make any other changes to your pages configuration between v8.6.3 and v9.4.0-alpha.2? Specifically:

   • Did you change pages.pagesPath?
   • Did you modify pages.customUrls?
   • Any other pages-related settings?

4. Redirect vs. CSS: How does the CSS styling issue relate to the issue title "Inconsistent Password Reset Redirect"? Are you experiencing both a redirect problem AND a CSS problem, or is the CSS missing because the redirect is going to the wrong page?

5. Screenshots: If possible, could you share screenshots or the actual HTML source (View Source in browser) of what you see in both v8.6.3 and v9.4.0-alpha.2 when you access the password reset page?

This information will help us determine whether this is a regression bug or a configuration issue.