includeEmailInRedirect flag is not working for removing Email from Redirect Link

[afra.n]

Hello,
We need to remove the email being passed in the query parameter when the user submits the password reset form. I’ve followed the instructions in this link:

How to disable "Include Email In Redirect"?

Customize Email Templates says that one of the URL parameters for the Verification Email link is, email if Include Email In Redirect is enabled in the template. By default, email is not included Where is the “Include Email In Redirect” option? I don’t see it on the Verification Email template page: [image] I found that the email was included in the URL, actually. How can I disable this?

However, even though the PATCH request to management API goes through, successfully changing the flag to false, we can still observe the email in the redirect link which looks like:

http://ourRedirectUrl/?email=user123%40ourdomain.com&success=true&message=You%20can%20now%20login%20to%20the%20application%20with%20the%20new%20password.&invitation=false

Our app is failing an important security assessment due to plainly visible email (considered PII) in the URL. As we’ve changed the flag as per the other thread and it’s not working, please suggest other steps.

We’re using classic universal login with custom Password Reset page for reference.

[afra.n]

Sharing the solution that I received from the support team here:
If you’re using management API’s “Create a password change ticket” endpoint as we are doing, you’ve to set the flag to false in the “Create a password change ticket” call, as it defaults to true, overriding the steps in the first link in my question.

[lihua.zhang]

Thank you @afra.n for sharing the solution with us!

[afra.n]

thanks to @matt.spence for his help, i’m just relaying here