Skip to content

Conversation

@octoper
Copy link
Member

@octoper octoper commented Dec 4, 2025

🔎 Previews:

What does this solve?

New "Force Password Reset" session task was added

What changed?

  • Introduced a new section in the session tasks guide for the password reset task.
  • Added error handling details for compromised passwords in the custom flows documentation.
  • Documented the <TaskResetPassword /> component for rendering the password reset UI.
  • Updated the password protection guide to include instructions for manually marking passwords as compromised.

Checklist

  • I have clicked on "Files changed" and performed a thorough self-review
  • All existing checks pass

@vercel
Copy link

vercel bot commented Dec 4, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Updated (UTC)
clerk-docs Ready Ready Preview Dec 11, 2025 2:47am

### Password compromised
If you have marked a user's password as compromised and they have another identification method to sign-in, you will receive an HTTP status of `422 (Unprocessable Entity)` and the following error payload:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what do you mean by "they have another identification to sign-in"
like the user tries to sign in using their email and password, but also has a phone number on their account? or what do you mean here

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If they have email and password, they can just user email code/link if supported but also if they had phone number on their account yeah they could use that, will revise her a bit here to make it more clear!

sdk: js-frontend, nextjs, react, react-router, remix, tanstack-react-start
---

![The \<TaskResetPassword /> component renders a UI for resolving the reset-password session task.](/docs/images/ui-components/task-reset-password.png){{ style: { maxWidth: '460px' } }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the component reference needs a picture!

@alexisintech
Copy link
Member

looks great 😸💖 left a few comments to resolve! @octoper

@github-actions
Copy link
Contributor

github-actions bot commented Dec 8, 2025

⚠️ TypeDoc files detected in this PR

This PR modifies files in the 'clerk-typedoc/' folder. These files are auto-generated from the clerk/javascript repository and should not be edited directly.

To make changes to TypeDoc documentation:

  1. 🔄 Make your changes in the appropriate files in the clerk/javascript repository.
  2. 🚀 The TypeDoc documentation will be pulled through to this repository via a CI action.

Thanks for contributing! 🙏

octoper and others added 6 commits December 9, 2025 12:35
- Introduced a new section in the session tasks guide for the password reset task, including its key and description.
- Added error handling details for compromised passwords in the custom flows documentation.
- Documented the `<TaskResetPassword />` component for rendering the password reset UI.
- Updated the password protection guide to include instructions for manually marking passwords as compromised.

# Conflicts:
#	docs/guides/configure/session-tasks.mdx
- Updated the error handling section for compromised passwords in the custom flows guide.
- Improved the sign-in example for Next.js, enhancing clarity and code formatting.
- Adjusted the password protection guide to streamline instructions for marking passwords as compromised.
- Simplified the `mountTaskResetPassword` function documentation for better readability.
@octoper octoper force-pushed the vaggelis/user-4117-docs-introduce-the-new-reset-passowrd-task branch from 74f68ea to 85df3a4 Compare December 9, 2025 10:35
@alexisintech
Copy link
Member

how is a user's password considered compromised? (without manually marking it)
is it if they have tried to sign in too many times, or from a different device?

@octoper
Copy link
Member Author

octoper commented Dec 12, 2025

@alexisintech We already have the Reject compromised password which is the "automatic" way, although this is handled a bit differently right now, but our goal is to consolidate those two flows in the future

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants