Forgot Credentials functionality
Synopsis
The Bloomreach Accelerator: B2C Commerce provides OOTB basic components and templates supporting credentials reset. The credential reset components invoke the related operations of CustomerRepository implemented by the specific Commerce Connector Module. Bloomreach Accelerator: B2C Commerce Application does not include the implementations for the supported connectors yet. So, until the operations of the specific Commerce Connector Module are implemented, the reset credentials components cannot work properly.
Component Overview
The Commerce Connector SDK API introduced two new operations in the CustomerRepository: please have a look at the reset credentials methods introduced in the Customer Repository.
Reset credentials pages/components are not enabled by default in the Bloomreach Accelerator: B2C Commerce boot application. The related components implemementation needs to be extended in most of the cases considering specific scenarios. The next paragraph details how to enable this functionality and how to extend accordingly.
Component Details
The Bloomreach Accelerator: B2C Commerce library provides the following components dealing with the credentials reset operation:
- ForgotCredentialsComponent
- ResetCredentialsComponent
These two components are based on the HST components: the current implementation is mainly focused on the forgot password reset flow. These components/templates can be extended to support other requirements, such as forgot username, security questions etc.
Reset credentials pages are not enabled in Bloomreach Accelerator: B2C Commerce by default: this means that the related pages are not "reachable" from the login form. In order to display the forgot link, the isCredentialsResetEnabled component configuration must be set to true.
Depending on your specific backend, connector component service base url, method type and request body must be specified accordingly. Once the new connector component has been published, the login page will display a new link pointing to the forgot credentials form.
The reset credentials flow included with Bloomreach Accelerator: B2C Commerce is designed to be compliant to the Forgot Password Cheat Sheet [1] defined by the OWASP foundation. The reset credentials components does not implement all the requirements specified in that Cheat Sheet, but the implementation provided by default can be extended depending on the specific requirements. At the moment, Bloomreach Accelerator: B2C Commerce provides two different pages/components compliant to the reset flow suggested by OWASP:
- The page rendering the forgot credentials form (powered by the ForgotCredentialsComponent)
- The page rendering the reset password form (powered by the ResetCredentials component)
Considering the flow suggested by OWASP, an ideal implementation of the credentials reset flow in a Bloomreach Accelerator: B2C Commerce application should be compliant to the following points:
- Use the ForgotCredentialsComponent in order to precess the forgot credentials request
- Use the custom requestCredentialsReset commerce connector implementation to send a token over a side channel
- Use the ResetCredentialsComponent to process the new credentials
- Use the credentialsReset commerce connector implementation to propagate the new credentials and log accordingly
As a general practice, sensible data (e.g. tokens) should not be stored in the Bloomreach Accelerator: B2C Commerce application.
Template Details
At the moment, the Bloomreach Accelerator: B2C Commerce Boot application provides two templates for the Reset Credential components:
- starterstore-forgot-form.ftl displaying the forgot password form.
- starterstore-productlist-atc.ftl displaying the reset password form.
References
[1] https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Forgot_Password_Cheat_Sheet.md