Reset a password with Fortify and Vue

Fortify already exposes the forgot-password and reset-password URLs. The Vue form posts those fields and no others.

1 min read

For your AI agent

Copies a prompt. Paste it into the AI agent you already have open.

Read https://laravel-vuejs.space/fortify-password-reset-vue.md
Fortify already exposes the forgot-password and reset-password URLs. The Vue form posts those fields and no others.
Do not branch the Vue page on "we found that user".
Do not put the new password in a query string, and do not email the new password back.
Show the diff. Do not commit.
On this page · 3 sections
  1. The fix
  2. What to avoid
  3. FAQ

People searching “Fortify password reset Vue” add a PasswordResetController beside the one Fortify registered. Turn the feature on and post to Fortify. The Fortify guide is the rest of the auth surface.

TL;DR

  • Fortify already exposes the forgot-password and reset-password URLs.
  • The Vue form posts those fields and no others.
  • Do not branch the Vue page on “we found that user”.
  • Do not put the new password in a query string, and do not email the new password back.

Who it's for: Laravel + Vue developers

Applies to: Laravel 13 · Vue 3

The fix#

config/fortify.php needs Features::resetPasswords(). The kit pages live under resources/js/pages/auth/. The forgot form sends one field:

typescript
form.post("/forgot-password");

form.email is the only key. Fortify always responds as if the address might exist. Do not branch the Vue page on “we found that user”.

The mail link opens the reset page with a token prop. That form posts:

typescript
form.token = token;
form.email = email;
form.post("/reset-password");

The fields are token, email, password, and password_confirmation. form.errors.email or form.errors.password is the failure. A 419 on this POST is the session cookie, not a bad token.

What to avoid#

Gotcha

Do not put the new password in a query string, and do not email the new password back.

FAQ#

How do I reset a password with Fortify and Vue?

Fortify already exposes the forgot-password and reset-password URLs. The Vue form posts those fields and no others.

What goes wrong with Fortify password reset Vue?

Many developers add a PasswordResetController beside the one Fortify registered. Do not branch the Vue page on "we found that user".

Found this useful?

Ask questions, share what you built.

Join thousands of Laravel and Vue developers in our Facebook group, or get new posts in your Telegram feed. Sharing this article helps too.

Join the Facebook group Follow on Telegram

Keep reading

Newsletter

Get the best of Laravel & Vue, once a month.

One short email with new guides, release notes worth reading and hand-picked community links. No spam, unsubscribe any time.

RSS feed Telegram channel