Developer forum

Forum » Dynamicweb 10 » Authenticate user issue

Authenticate user issue

E-mail notifications
Jason Htin Lin Aung
Reply
Posted on 13/05/2026 13:30:58

Hi

We allowed to register new users by using UserManagementServices.Users.Save(user) and set the password with user.Password= "Password". After registration, the user can login successfully with username and password in website. But when we try to authenticate by using api via /dwapi/users/authenticate, and it is responding 403. Only after IIS is recycled, api responses token. Am I missing something?


Replies

 
Nicolai Pedersen Dynamicweb Employee
Nicolai Pedersen
Posted on 13/05/2026 14:08:48
Reply
This post has been marked as an answer

First of all - it is a very bad idea to set a password to "Password". I strongly recommend that you refrain from even setting any password on a user as they should do that themselves. Never generate one for them or send it to them by email etc. 

It is a big security issue to allow these things.You cannot do these things in 2026 as it will go wrong...

For onboarding they should get a user and then an email where they can set their password them selves.

When you do user.password = "" you overwrite directly on the database.

The system expects encrypted passwords and enforcment of password rules. So you should do a UserManagementServices.Users.ChangePassword(user, password) that will handle more things for you.

Votes for this answer: 1
 
Jason Htin Lin Aung
Posted on 14/05/2026 11:23:38
Reply

Hi Nicolai ,

Thank you for reminding regarding to the password security.

Actually our customize api is creating using by user inputs like user.Password = {{UserInputPassword}} and we only allow policy met passwords.

UserManagementServices.Users.ChangePassword(user, password) is works and now I can get the token via /dwapi/users/authenticate.

 

You must be logged in to post in the forum