Answers.Body: <p>In case anyone makes the same silly mistake I did, I had a conditional on the sign-in page that redirected folks to the page they were on before signing in.</p>
  
  <p>After a password reset, it was trying to redirect back to the Set Password screen with the reset token, resulting in the error.</p>
  
  <p>I just adjusted the conditional so it ignored the referrer URL if it was a control panel action. Problem solved.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-23T20:24:41.223Z
Answers.LastActivityDate: 2018-01-23T20:24:41.223Z
Answers.UserDisplayName: Travis Gertz
Body: <p>I've had a few users on our site have trouble resetting their password. They go through our "Forget password" flow on the front-end of our site, receive the reset email, which allows them to create a new password. But when they try sign in, they receive the following error:</p>
  
  <p><a href="https://i.sstatic.net/eaMRu.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/eaMRu.png" alt="enter image description here"></a></p>
  
  <p>Based on <a href="https://craftcms.stackexchange.com/questions/21352/invalid-verification-code-please-login-or-reset-your-password">this thread</a>, I thought the issue might have been our email parsing… but here's the weird thing… same thing happens when I grab the reset link directly from the control panel using this dialog then pasting it directly in a different (signed-out) browser:</p>
  
  <p><a href="https://i.sstatic.net/FzUZQ.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/FzUZQ.png" alt="enter image description here"></a></p>
  
  <p>I'm getting the exact same error every time I try it with either method (this was definitely working a few months ago on the same server, PHP version, etc).  Any ideas? Thanks!</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-17T14:43:14.657Z
Comments.Text: In both cases, are you getting that error when you click on the link in the email or when you try to actually login to the Control Panel?
Comments.UserDisplayName: Brad Bell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-17T19:08:24.573Z
Comments.Text: In both cases, the link works and I can successfully enter a new password… it then redirects me to my front-end sign-in form as expected.
  
  The error displays when I then try to sign in using that front-end sign-in form.
Comments.UserDisplayName: Travis Gertz
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-17T19:18:13.800Z
Comments.Text: Okay… weird update:
  
  If I navigate away from the sign-in form, then come back directly using the naked sign-in url, I can successfully sign in with the new password. So it's ONLY after I reset the password, get auto-redirected to my sign-in page, then attempt to sign in.
  
  Also, this seems to only occur with users who don't have control panel access.
Comments.UserDisplayName: Travis Gertz
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-19T00:39:45.710Z
Comments.Text: Yeah... not much of that makes sense. :)  If this is on a public box and you want to send some CP/SSH or FTP credentials over to support@craftcms.com, we can poke around a bit.
Comments.UserDisplayName: Brad Bell
Tags: <error-message><password><hash>
Title: Getting "Invalid verification code." on password reset
ThreadText: # Getting "Invalid verification code." on password reset
  
  (Asked by: username_0 on 2018-01-17)
  
  I've had a few users on our site have trouble resetting their password. They go through our "Forget password" flow on the front-end of our site, receive the reset email, which allows them to create a new password. But when they try sign in, they receive the following error:
  
  [![enter image description here](https://i.sstatic.net/eaMRu.png)](https://i.sstatic.net/eaMRu.png)
  
  Based on [this thread](https://craftcms.stackexchange.com/questions/21352/invalid-verification-code-please-login-or-reset-your-password), I thought the issue might have been our email parsing… but here's the weird thing… same thing happens when I grab the reset link directly from the control panel using this dialog then pasting it directly in a different (signed-out) browser:
  
  [![enter image description here](https://i.sstatic.net/FzUZQ.png)](https://i.sstatic.net/FzUZQ.png)
  
  I'm getting the exact same error every time I try it with either method (this was definitely working a few months ago on the same server, PHP version, etc). Any ideas? Thanks!
  
  **Tags:** error-message, password, hash
  
  > **Comments:**
  > **username_1**: In both cases, are you getting that error when you click on the link in the email or when you try to actually login to the Control Panel?  
  > **username_0**: In both cases, the link works and I can successfully enter a new password… it then redirects me to my front-end sign-in form as expected.  The error displays when I then try to sign in using that front-end sign-in form.  
  > **username_0**: Okay… weird update:  If I navigate away from the sign-in form, then come back directly using the naked sign-in url, I can successfully sign in with the new password. So it's ONLY after I reset the password, get auto-redirected to my sign-in page, then attempt to sign in.  Also, this seems to only occur with users who don't have control panel access.  
  > **username_1**: Yeah... not much of that makes sense. :)  If this is on a public box and you want to send some CP/SSH or FTP credentials over to support@craftcms.com, we can poke around a bit.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2018-01-23. Score: 2 | Accepted answer
  
  In case anyone makes the same silly mistake I did, I had a conditional on the sign-in page that redirected folks to the page they were on before signing in.
  
  After a password reset, it was trying to redirect back to the Set Password screen with the reset token, resulting in the error.
  
  I just adjusted the conditional so it ignored the referrer URL if it was a control panel action. Problem solved.
  
  
  ---
  
  