Laravel: received password reset link with username instead of token

Question

I'm using the Laravel 5.8 built-in auth scaffolding. I was just trying the password reset functionality. I go to the route password/reset and I get the form where to insert my email address, I submit it and I correctly receive an email, but, the URL to the reset page contains the username of the user who requested the reset instead of the token.

Because of this, when I follow the reset link and I try to submit the form to reset the password I get a validation error massage which says that the token is worng, infact into the token hidden field the value is set to the username instead of the token, as arrives as parameter from the wrong URL. Inside the password_resets table there is the correct token which should be sent by email.

Inside the web.php file, Auth::routes(); is at the top, so there shouldn't be any conflict with my routes.

Why Laravel is sending a wrong URL? What should I check?

Edit: Inside the LoginController the only thing changed is the overrided credentials() function:

protected function credentials(Request $request)
{
    // This adds the check over the verify_token field upon login
    // the field must be null to pass the check
    return [
        'email'        => $request['email'],
        'password'     => $request['password'],
        'verification_token' => null
    ];
}

I've added some code. I also have to say that I'm using Socialite, but I doubt that it could be the cause. — Luigi Caradonna
And what about without your change? Does it work? Your change does not seems to mess with that code, but just in case you can try commenting out the method. — nakov
Did you override username(), like mentioned in the documentation? or something in your User model? — Robbin Benard

Luigi Caradonna Luigi Caradonna · Accepted Answer · 2019-07-02T21:36:59

My bad (of course). I left this project for a few months and I forgot to have also overridden the email's template, I messed up with it. Thank you anyway for your time and sorry.

Laravel: received password reset link with username instead of token

1 Answers