Any idea why the following would be ignored following a frontend new password form? The user group does not have access to the control panel.

'setPasswordPath' => 'account/login/password/new',

The following success path on the next line works fine:

'setPasswordSuccessPath' => 'account/login/password/done',

The user workflow:

  1. Start on frontend Register form with firstname, lastname, email and password.
  2. Account created and user is logged-in. No email confirmation needed.
  3. User logs out.
  4. User completes Forgotten Password form and email is sent.
  5. User clicks password link in email and sees the Craft CMS password form.

I've tried this with and without the email address having a pre-existing Craft Commerce order associated with it. The result is the same.

  • Can you describe the front-end user workflow where it's not working and what you're seeing instead? If this for a brand new user where there wasn't a password field on user creation? An existing user that's just updating their password?
    – Brad Bell
    Commented Mar 10, 2017 at 18:57
  • Hi Brad. I've updated the question to include the user workflow. Commented Mar 13, 2017 at 9:34
  • 1
    You're positive the user you're testing with doesn't have CP access and that a template exists at account/login/password/new? The logic Craft uses there is pretty straight-forward: github.com/pixelandtonic/Craft-Release/blob/master/app/…
    – Brad Bell
    Commented Mar 13, 2017 at 22:55
  • I have the exact same issue... The link in the email is set to mysite.com/actions/users/setpassword?code=x&id=y. instead of the mysite.com/passwordPath?code=x&id=y. And even if you copy the query part to the template you've specified in setPasswordPath, it does not display that template, but only the internal template. is this a bug or don't I understand the setting?
    – outline4
    Commented Jun 21, 2017 at 18:16
  • and to worsen things: the user is not automatically logged in after setting the new password... it redirects fine to setPasswordSuccessPath but the user is not logged in. that is in Craft CMS 2.6.2982.
    – outline4
    Commented Jun 21, 2017 at 18:18

2 Answers 2


Picking this up with another project, it looks like the problem was me not specifying a template path as the 'setPasswordPath' config setting. Instead, I was passing a route. I was doing this because I wanted to use the same password template to handle everything to do with passwords. This isn't possible, by the looks of it, because the controller is looking for the existence of a file (as opposed to a template being returned from a route or URI).

As soon as I changed it to a strict template path everything worked fine, and the following line in UsersController.php no longer returns false:

if (craft()->templates->doesTemplateExist($templatePath))

So this is solved.

  • 2
    Follow-up from 11 months later... impressive!
    – Brad Bell
    Commented Feb 1, 2018 at 23:42
  • But I don't want the end user being sent a URL in an email that contains a path to a file. That's... silly? Plus, I put these files that should not be directly accessible inside a _hidden folder specifically to stop direct access. You get to URLs through routes, damn it. Commented Apr 17, 2019 at 10:41
  • Thanks so much. I've been struggling with the same thing.
    – outline4
    Commented Oct 25, 2019 at 11:30
  • I'm all with @MattWilcox it should be possible to add a route.
    – outline4
    Commented Oct 25, 2019 at 11:31

In case someone is still having issues. setPasswordPath is actually expecting a template path and not a route.

'setPasswordPath' => 'myauth/set-password'

I have a file that lives in here:

MyCraftProjectFolder > templates > myauth > set-password.twig

Some may get confused because of the name "Path" at the end of setPasswordPath as many other config names include the word Paths and is expecting a route path. In this case setPasswordPath is expecting a template path.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.