<p>In case anyone makes the same silly mistake I did, I had a conditional on the sign-in page that redirected folks to the page they were on before signing in.</p>

<p>After a password reset, it was trying to redirect back to the Set Password screen with the reset token, resulting in the error.</p>

<p>I just adjusted the conditional so it ignored the referrer URL if it was a control panel action. Problem solved.</p>

CC BY-SA 3.0
2018-01-23T20:24:41.223Z
2018-01-23T20:24:41.223Z
Travis Gertz
<p>I've had a few users on our site have trouble resetting their password. They go through our "Forget password" flow on the front-end of our site, receive the reset email, which allows them to create a new password. But when they try sign in, they receive the following error:</p>

<p><a href="https://i.sstatic.net/eaMRu.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/eaMRu.png" alt="enter image description here"></a></p>

<p>Based on <a href="https://craftcms.stackexchange.com/questions/21352/invalid-verification-code-please-login-or-reset-your-password">this thread</a>, I thought the issue might have been our email parsing… but here's the weird thing… same thing happens when I grab the reset link directly from the control panel using this dialog then pasting it directly in a different (signed-out) browser:</p>

<p><a href="https://i.sstatic.net/FzUZQ.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/FzUZQ.png" alt="enter image description here"></a></p>

<p>I'm getting the exact same error every time I try it with either method (this was definitely working a few months ago on the same server, PHP version, etc).  Any ideas? Thanks!</p>

CC BY-SA 3.0
2018-01-17T14:43:14.657Z
In both cases, are you getting that error when you click on the link in the email or when you try to actually login to the Control Panel?
Brad Bell
CC BY-SA 3.0
2018-01-17T19:08:24.573Z
In both cases, the link works and I can successfully enter a new password… it then redirects me to my front-end sign-in form as expected.

The error displays when I then try to sign in using that front-end sign-in form.
Travis Gertz
CC BY-SA 3.0
2018-01-17T19:18:13.800Z
Okay… weird update:

If I navigate away from the sign-in form, then come back directly using the naked sign-in url, I can successfully sign in with the new password. So it's ONLY after I reset the password, get auto-redirected to my sign-in page, then attempt to sign in.

Also, this seems to only occur with users who don't have control panel access.
Travis Gertz
CC BY-SA 3.0
2018-01-19T00:39:45.710Z
Yeah... not much of that makes sense. :)  If this is on a public box and you want to send some CP/SSH or FTP credentials over to support@craftcms.com, we can poke around a bit.
Brad Bell
<error-message><password><hash>
Getting "Invalid verification code." on password reset
# Getting "Invalid verification code." on password reset

(Asked by: username_0 on 2018-01-17)

I've had a few users on our site have trouble resetting their password. They go through our "Forget password" flow on the front-end of our site, receive the reset email, which allows them to create a new password. But when they try sign in, they receive the following error:

[![enter image description here](https://i.sstatic.net/eaMRu.png)](https://i.sstatic.net/eaMRu.png)

Based on [this thread](https://craftcms.stackexchange.com/questions/21352/invalid-verification-code-please-login-or-reset-your-password), I thought the issue might have been our email parsing… but here's the weird thing… same thing happens when I grab the reset link directly from the control panel using this dialog then pasting it directly in a different (signed-out) browser:

[![enter image description here](https://i.sstatic.net/FzUZQ.png)](https://i.sstatic.net/FzUZQ.png)

I'm getting the exact same error every time I try it with either method (this was definitely working a few months ago on the same server, PHP version, etc). Any ideas? Thanks!

**Tags:** error-message, password, hash
> **Comments:**
> **username_1**: In both cases, are you getting that error when you click on the link in the email or when you try to actually login to the Control Panel?  
> **username_0**: In both cases, the link works and I can successfully enter a new password… it then redirects me to my front-end sign-in form as expected.  The error displays when I then try to sign in using that front-end sign-in form.  
> **username_0**: Okay… weird update:  If I navigate away from the sign-in form, then come back directly using the naked sign-in url, I can successfully sign in with the new password. So it's ONLY after I reset the password, get auto-redirected to my sign-in page, then attempt to sign in.  Also, this seems to only occur with users who don't have control panel access.  
> **username_1**: Yeah... not much of that makes sense. :)  If this is on a public box and you want to send some CP/SSH or FTP credentials over to support@craftcms.com, we can poke around a bit.  

---

## 1 answers

### Answer by username_0 on 2018-01-23. Score: 2 | Accepted answer

In case anyone makes the same silly mistake I did, I had a conditional on the sign-in page that redirected folks to the page they were on before signing in.

After a password reset, it was trying to redirect back to the Set Password screen with the reset token, resulting in the error.

I just adjusted the conditional so it ignored the referrer URL if it was a control panel action. Problem solved.


---

