Redmine

When clicking on the lost password link with a token, we validate the token, and if valid, save it in the current session and redirect the user to the lost password action without the token. Here, we check the session for the token and ask the user to set a new password. For most errors along the way (such as an invalid or expired token), we set flash error messages.

About the only way I can imagine that we accept a token and redirect to the lost_password page again to ask for the email address without any flash error would be that you have somehow misconfigured your sessions, resulting in the session cookie not to be stored and sent correctly. This could happen if you use multiple distinct hostnames with redirects or some component on your server blocks cookies.

Unfortunately, this is hard to debug remotely and you may need to check the various server components on your server on your own. Things to check for include:

• Are you always using the exact same hostname? Is the hostname in the emails the same as the one you normally use to login to your Redmine?
• Are you always using the same protocol (http vs. https)
• Is there some server component (such as a webserver or proxy server or web firewall) which does not forward or block cookies?

In any case, make sure that the hostname and protocol configured in Administration -> Settings matches the hostname configured in your webserver.

Did you get a chance to look at this? I added all details and images in text instead.

Sorry, I missed your answer.
Thankyou. I will check with my technician to see if we can solve this.

I will get back to you with test results.

Hi,

We managed to solve the issue. We had to change the protocol.
Thanks for your help!