With one particular user this is failing. With any other user that I try it works, but for this one user not matter what I do this call fails with the "INVALID_PASSWORD" error.
firebaseRef.changePassword({
email: <email-address>,
oldPassword: <resettoken>,
newPassword: <newpassword>
}, function(err) {
// {"error":{"code":"INVALID_PASSWORD","message":"The specified password is incorrect."}}
})
I've tried
- Using a simple password that worked for the same reset password flow with a different email address (rules out the possibility of the new password being invalid)
- Sending the reset password email again and making sure to use the link with the most recent reset token
- Going through the reset password flow on a different account (worked fine, several times)
Out of ideas here... it just seems to be this one account.
Turns out the receiver's email client was down-casing the href in the URL, this caused the token param to be incorrect (it's case sensitive)
This was the link my email template (plain text):
With that plan text url^ it appears that the one email this customer used down-cased the link. Solution is to add an html template: