-
Suggestion
-
Resolution: Unresolved
-
None
-
None
-
1
-
NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion.
There should be a built in configuration setting that allows an Admin to simply disable the "Forgot Password?" functionality without having to add styles and modify templates.
We're currently utilizing the solutions in the workarounds provided below, but we'd like to see this functionality built into Confluence.
Known Workarounds:
https://answers.atlassian.com/questions/102042/remove-forgot-paassword-link-in-confluence
https://confluence.atlassian.com/display/CONF41/Disabling+Password+management+from+User
- relates to
-
- Gathering Interest
- mentioned in
-
![[Extranet] Page](/images/icons/generic_link_16.png "[Extranet] Page")
Page
Failed to load
| Form Name | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
[CONFSERVER-32692] Add a configuration setting that allows an Admin to disable the "Forgot Password?" functionality.
Thanks Guy, I just don't think we are going to implement another setting to disable this feature. It makes no sense if we solve the root of the problem.
Guy Anela
added a comment - Hi Sherif - I think that's a good "additional" feature, but I still think it would be nice to be able to easily disable the feature through the GUI. 
Guy Anela
added a comment - Hi Sherif - I think that's a good "additional" feature, but I still think it would be nice to be able to easily disable the feature through the GUI. Thanks for the information, ganela.
I've spoken about this with one of our security specialists. And we're wondering if the bigger issue here is that the forgot password functionality shouldn't acknowledge if a username is correct or not - that sounds like the ideal solution to the problem, rather than adding another setting to an already crowed product full of settings.
Are you okay with that? If so I'd like to rename this issue.
Hey Sherif - Obviously there are others out there that want to do this as well (See workaround links I provided in the description above), but here are a couple of reasons why we want to be able to do this...
1. To prevent potential hack attempts. Last week someone tried to hack our public facing Confluence site using the "Forgot Password?" functionality. This site only has a few users so we decided it'd be best if we simply disabled the "Forgot Password" functionality and managed the password resets manually.
2. To prevent attacks through email. It wouldn't be difficult for a malicious user to write a script that looped through the Forgot Password feature with a specific set of userids to send thousands of emails.
Guy Anela
added a comment - - edited Hey Sherif - Obviously there are others out there that want to do this as well (See workaround links I provided in the description above), but here are a couple of reasons why we want to be able to do this...
1. To prevent potential hack attempts. Last week someone tried to hack our public facing Confluence site using the "Forgot Password?" functionality. This site only has a few users so we decided it'd be best if we simply disabled the "Forgot Password" functionality and managed the password resets manually.
2. To prevent attacks through email. It wouldn't be difficult for a malicious user to write a script that looped through the Forgot Password feature with a specific set of userids to send thousands of emails.
Thanks for the feedback, Guy. To be honest, I'm not clear as to why we would implement this. Could you shed some light into why you are trying to do this?
Hi Sherif - I don't believe it really solves issue #2 I listed above and based on the number of Google results I came across while originally researching this, I'm guessing that there might be other legitimate reasons for wanting this feature added.
Anyhow, I'm not going to go back-and-forth on this. You guys make the ultimate decision so I'll leave it in your hands. I've already disabled the feature (manually) so it really doesn't affect us any longer... I just thought it might be nice to make it a little easier and more intuitive for others.
Cheers!