Password reset not public by default

Urls for login and logout are public if django.contrib.auth is installed but not password_reset, password_reset_done, password_reset_confirm nor password_reset_complete. Could you add theses ? I can make a PR later if you prefer.

[tchamberlin]

I just ran into this. For anyone else, it is indeed pretty straightforward to work around.

I set up the following public URLs:

STRONGHOLD_PUBLIC_NAMED_URLS = (
    "password_reset",
    "password_reset_done",
    "password_reset_confirm",
    "password_reset_complete",
)

password_reset_confirm cannot be reversed (since no parameters are given), and fails silently. So, you need to add:

STRONGHOLD_PUBLIC_URLS = ("^/accounts/reset/.*",)

To work around it.

[pvandegeer]

Adding them to settings manually like below doesn’t help. Am I missing something?

STRONGHOLD_PUBLIC_NAMED_URLS = ( 'password_reset', 'password_reset_done', 'password_reset_confirm', 'password_reset_complete', ) The views for password_reset and password_reset_done work. I think the view behind the password_reset_confirm url also initially works when following the link in the password reset e-mail. But the Django PasswordResetConfirmView then redirects to itself with a different token and that seems to get blocked, returning me to my LOGIN_URL.

It works as it should with the stronghold middelware disabled. Using Django 2.0 and Stronghold 0.3.0.