Forgot Password flow with JSON responses

[bsbeeks]

Is is possible to have the GET auth/password/edit endpoint return a url string, or the needed headers/tokens to reset the user's password, instead of redirecting? The way our applications are set up, the Rails app that is using devise_token_auth can't controller the User's experience...it's strictly a JSON API.

[nicholasshirley]

This is possible. Override the passwords controller, delete the redirect logic and send back the headers instead. I do this in an app, but I had to turn off config.check_current_password_before_update completely. Without the redirects it seems allow_password_change never gets set to true so there's no opportunity to give a new password without the old password if it's on, but I couldn't tell you why.

[zachfeldman]

Workaround posted, closing for now.