Skip to content

httpd: auto-redirect to change password page on mandatory password ch…#2194

Open
Orgenus wants to merge 1 commit intodrakkan:mainfrom
Orgenus:features/auto-redirect-must-change-password
Open

httpd: auto-redirect to change password page on mandatory password ch…#2194
Orgenus wants to merge 1 commit intodrakkan:mainfrom
Orgenus:features/auto-redirect-must-change-password

Conversation

@Orgenus
Copy link
Copy Markdown

@Orgenus Orgenus commented Mar 24, 2026

Checklist for Pull Requests


Auto-Redirect to Change Password Page on Mandatory Password Change

Summary

This PR adds a focused improvement to the WebUI login flow:
when a user or admin is required to change their password, they are now
automatically redirected to the change password page immediately after
a successful login.

Note on Turkish locale: We have submitted the Turkish (tr) language
translation separately via Crowdin
as suggested. It is not included in this PR.


Problem

When MustChangePassword (user) or RequirePasswordChange (admin) was set,
after a successful login the user was redirected to the normal landing page
(/web/client/files or /web/admin/users).
The checkAuthRequirements middleware would then block every subsequent
request with a Forbidden error, leaving the user with no visible path
forward and no indication of what they needed to do.

Solution

Added an explicit redirect to the change password page immediately after
login, before the normal landing page redirect.

loginUser — internal/httpd/server.go

if user.MustChangePassword() {
    http.Redirect(w, r, webChangeClientPwdPath, http.StatusFound)
    return
}

…ange

When a user or admin is required to change their password (MustChangePassword /
RequirePasswordChange), after successful login they are now immediately
redirected to the change password page instead of the normal landing page.

Previously, the checkAuthRequirements middleware would block every page with a
Forbidden error, leaving the user with no clear path forward.

- Web Client (loginUser): if user.MustChangePassword() redirect to /web/client/changepwd
- Web Admin (loginAdmin): if admin.Filters.RequirePasswordChange redirect to /web/admin/changepwd

The existing checkAuthRequirements middleware continues to enforce access
restrictions on all other pages when the password change requirement is active.
@Orgenus Orgenus requested a review from drakkan as a code owner March 24, 2026 14:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant