Question

Views

Auth.forgotPassword(username)

should return some error message. as written in documentation

If neither a verified phone number nor a verified email exists, an InvalidParameterException is thrown.

but it's not raising an exception, instead, I receive a success response.

"CodeDeliveryDetails":{"AttributeName":"email","DeliveryMedium":"EMAIL","Destination":"m***@g***.com"}}

I dont receive the email though.

what can be the reason ?

over 4 years ago · Santiago Trujillo

@ryan-hines oh my god thank you! I have been struggling with this for days.

We had a very similar problem:

The user registers through Google
User tries to reset password
We wanted to disallow this and tell them to use their social login (you'd think Cognito would take care of this part, but no)
- To solve this, we write a custom migration lambda to handle "UserMigration_ForgotPassword"
- Even though we threw an error in the lambda, it still showed a success message in the UI, but didn't send the email.

In the new Cognito UI, we had to enter:

Application Integration
Click on the application client
Click "Edit" in the customer information section of the app
At the bottom, under "Advanced security settings", uncheck "Prevent user existence errors"

The UI now correctly displays a failure when our lambda throws an error.

over 4 years ago · Santiago Trujillo Report

Answer question

Accepted Answer · 2022-05-03T16:01:24.388Z

I was seeing the same problem. It turned out related to this:

Use the PreventUserExistenceErrors setting of a user pool application client to enable or disable errors related to user existence.

After changing that setting in the user group to 'Legacy' from 'Enabled', I started seeing a 400 response:

 { "__type": "UserNotFoundException", "message": "Username/client id combination not found." }