djoser reset password keeps returning 403 forbidden

Question

I have djoser running with rest framework and simpleJWT for authentication and I have a react frontend, everything is working fine except when the frontend sends the post request to "..../auth/users/reset_password", it gives back a 403 forbidden and it does not send an email with the link containing the uid and token, I cannot seem to find the problem, can someone help with this issue?? here is the settings:


REST_FRAMEWORK = {
    # Use Django's standard `django.contrib.auth` permissions,
    # or allow read-only access for unauthenticated users.
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework_simplejwt.authentication.JWTAuthentication',
    ),

    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly',
        'rest_framework.permissions.IsAuthenticated',
    ]
}

DJOSER = {
    'LOGIN_FIELD': 'email',
    'USER_CREATE_PASSWORD_RETYPE': True,
    'USERNAME_CHANGED_EMAIL_CONFIRMATION': True,
    'PASSWORD_CHANGED_EMAIL_CONFIRMATION': True,
    'SEND_CONFIRMATION_EMAIL': True,
    'LOGOUT_ON_PASSWORD_CHANGE': True,
    'SET_PASSWORD_RETYPE': True,
    'PASSWORD_RESET_CONFIRM_RETYPE': True,
    'PASSWORD_RESET_CONFIRM_URL': 'password/reset/confirm/{uid}/{token}',
    'USERNAME_RESET_CONFIRM_URL': 'email/reset/confirm/{uid}/{token}',
    'ACTIVATION_URL': 'activate/{uid}/{token}',
    'SEND_ACTIVATION_EMAIL': True,
    'SERIALIZERS': {
        'user_create': 'authentication.api.serializers.UserCreateSerializer',
        'user': 'authentication.api.serializers.UserCreateSerializer',
        'user_delete': 'djoser.serializers.UserDeleteSerializer',
    }
}

SIMPLE_JWT = {
    'ACCESS_TOKEN_LIFETIME': timedelta(minutes=60),
    'REFRESH_TOKEN_LIFETIME': timedelta(days=1),
    'AUTH_HEADER_TYPES': ('JWT',),
}

Did you put the last slash in the URL localhost:8000/auth/users/reset_password Otherwise, it will be treated as a GET request it is forbidden. — Malik Faiq

Tomoya Nishida Tomoya Nishida · Accepted Answer · 2021-03-27T10:58:16

One of the typical things when 403 raises up is There's something wrong with the URL. Looks like perfect on Django side, so I recommend you to check the URL of the api request on frontend side.

djoser reset password keeps returning 403 forbidden

1 Answers