# 06-Feb-2026 — move forgot password flow to backend and fix credential modals [ref: #157](https://github.com/nbarrett/ngx-ramblers/issues/157)

## [build 469](https://github.com/nbarrett/ngx-ramblers/actions/runs/21770042279) — [commit 3e9cb24](https://github.com/nbarrett/ngx-ramblers/commit/3e9cb241d38476d89b9236f3e248df663c9c2413)

_____

The forgot password feature was broken for users who were not logged in. This fix
moves the password reset email process entirely to the server so it works reliably
for all users regardless of login state.
## Forgot password - new experience
- When opening "I've forgotten my password", users are now presented with two ways
to verify their identity via radio buttons
- **"I know my email address or username"** (selected by default) — enter the email
address or username from your original welcome email
- **"I don't know my email or username"** — enter your Ramblers membership number and
home postcode instead, so you can still reset your password without remembering
your login details
- After submitting, a confirmation message is shown and the form becomes read-only
to prevent duplicate requests
- For security, the same message appears whether or not the details matched a member,
so no one can use this form to discover who is or isn't a member
- Postcodes are accepted in any format — with or without spaces, upper or lower case.
For example "tn263hf", "TN26 3HF", and "tn26 3hf" are all treated the same
## Login and password reset - now more flexible
- All login and password-related dialogs now accept either your **email address** or
**username** wherever you see an identity field — you no longer need to remember which
one you registered with
- Fields are labelled **"Email address or username"** to make this clear
## Login on mobile - autofill fix
- Previously, when your phone or browser auto-filled your saved username and password,
the Login button could remain greyed out even though the fields appeared filled in
- This is now fixed — the Login button is always clickable and validates your
credentials when you tap it
## Modal dialog behaviour
- Login, forgot password, and reset password dialogs can now only be closed using the
explicit buttons (Close, Cancel, Start Over etc.) — clicking outside the dialog or
pressing Escape no longer dismisses them, preventing accidental loss of entered data
- All credential dialogs have consistent, compact button layout that displays correctly
on both desktop and mobile without wrapping
## Postcode normalisation
- The shared `normalisePostcode` function now correctly handles postcodes entered
without spaces by stripping all whitespace, matching the UK postcode pattern, and
re-inserting the standard space before the last 3 characters
- This benefits both the forgot password flow and the existing postcode lookup service
## Technical changes
- New server-side endpoint handles member lookup, password reset ID generation, and
Brevo transactional email sending in a single request
- Debug logging enabled on the forgot password endpoint for operational visibility
- Removed legacy client-side forgot password controller, auth route, and unused
service methods
- Reset password modal template and empty stylesheet inlined into the component
- Disabled noisy aws-controllers debug logging