hybrid remote app with customer portal reset password issue

Question

I have a hybrid remote app that uses a custom login page to authenticate through customer portal and land on a custom VF page. This works fine, however if the user resets their password they get stuck in a loop on the custom login page (login and return to login page).

If they get stuck in the loop and shut down the app and then restart it they're able to login fine. It feels like its losing the startURL parameter that comes from the app on load during the password reset process.

Here's my best guess of the flow that is going on:

successful login flow:

1. App loads custom login page using sfdcoauthloginhost parameter in the app's .plist file
2. The custom login page is loaded with a startURL parameter /mobile/setup/secur/RemoteAccessAuthorizationPage.apexp?source==LONGSTRINGOFCHARS
3. It then fires login which goes to : https://MYSITE.cs15.force.com/mobile/secur/frontdoor.jsp?LOTSOFURLPARAMS
4. It then uses the startPage property of bootconfig.json to somehow redirect it to the correct VF landing page upon successful login?

Reset password flow

1. the same
2. the same
3. user clicks reset password
4. they enter their username and confirm reset
5. they are told their new password has been emailed to them and click to return to login page
6. the login page at this point has seemingly lost the original startURL parameter
7. they login and create their new password and are returned to the login page
8. they login using their new password and are stuck in a loop since there is no startURL parameter

Can anyone provide clarification around how this flow actually works and any ideas on how to solve the loop after resetting password would be great!

Login controller for reference:

 public Ctl_MobileLogin () {

   startURL = System.currentPageReference().getParameters().get('startURL');
}

public PageReference login() {
    return Site.login(username, password,startURL);
}

Thanks in advance!

Answer 1

Since you're using a custom login screen, I'd also customize your forgot password screen to propagate that state back to the login screen. Pass it and return it as a startURL

Answer 2

Here was my solution:

I customized the initial login page so that the user could simply enter their username in the username field click reset password to reset their password without leaving the page. They receive an apex:pagemessage confirming its been reset, and can then login with the temp. password, proceed to the changepassword page and login.

I believe removing steps 4-7 from above and letting them simply stay on the login page keeps the url parameters.