Method handlePasswordReset

packages/memos-core/src/viewer/server.ts:489–519

(req: http.IncomingMessage, res: http.ServerResponse)

  }

  private handlePasswordReset(req: http.IncomingMessage, res: http.ServerResponse): void {
    this.readBody(req, (body) => {
      try {
        const { token, newPassword } = JSON.parse(body);
        if (token !== this.resetToken) {
          res.writeHead(403, { "Content-Type": "application/json" });
          res.end(JSON.stringify({ error: "Invalid reset token" }));
          return;
        }
        if (!newPassword || newPassword.length < 4) {
          res.writeHead(400, { "Content-Type": "application/json" });
          res.end(JSON.stringify({ error: "Password must be at least 4 characters" }));
          return;
        }
        this.auth.passwordHash = this.hashPassword(newPassword);
        this.auth.sessions.clear();
        this.saveAuth();
        this.resetToken = crypto.randomBytes(16).toString("hex");
        this.log.info(`memos-local: password has been reset. New reset token: ${this.resetToken}`);
        const sessionToken = this.createSession();
        res.writeHead(200, {
          "Content-Type": "application/json",
          "Set-Cookie": `${this.cookieName}=${sessionToken}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
        });
        res.end(JSON.stringify({ ok: true, message: "Password reset successfully" }));
      } catch (err) {
        res.writeHead(400, { "Content-Type": "application/json" });
        res.end(JSON.stringify({ error: String(err) }));
      }
    });
  }

  // ─── Pages ───