NGUYỄN ANH TUẤN

Hi umihei,

Thank you for reaching out about the issue you encountered with the password reset functionality when using EJS templates. I appreciate you sharing the details.

The reason it works in Postman but not in the browser with EJS is because of how the token is being passed.

In Postman, you are explicitly adding the token to the URL as a query parameter, like this: http://localhost:3000/auth/reset-password?token=copiedToken

However, when submitting the form from the EJS template in the browser, the token is not being included as a query parameter in the URL. Instead, it seems the token is only present in the Referer header of the request.

To resolve this, you have a couple options:

1. Include the token as a hidden input field in your EJS form:

<form action="/auth/reset-password" method="POST">
  <input type="hidden" name="token" value="<%= token %>">
  <!-- other form fields -->
  <button type="submit">Reset Password</button>
</form>

Then in your /auth/reset-password route handler, you can access the token from req.body.token instead of req.query.token.

2. Alternatively, you can extract the token from the Referer header as you have done:

const refererURL = req.headers.referer;
const headerToken = refererURL.substring(46); 

And then use headerToken in place of req.query.token in your resetPassword controller function.

I recommend going with option 1 and including the token in the form body if possible, as it is a more standard and explicit way of passing data from a form submission.

The reason it works smoothly in Postman is because Postman allows you to construct the request URL and parameters exactly as needed. But when submitting a standard form in the browser, the form data is sent in the request body by default.

I hope this helps clarify the issue and provides a solution! Let me know if you have any other questions.

Best regards, Tuấn