How to set recovery question in Okta Sign in widget


#1

How can I use the okta sign in widget to let the user set their challenge question and answer in the reset password flow?

Scenario:

  1. The user gets a ‘reset password’ email with link.
  2. The link goes to our app integrated with Okta sign in widget.
    myapp.com/signin/reset-password/${recoveryToken}
  3. The user has to answer the recovery challenge. So the widget navigates to /signin/recovery-question

In the UI, there is an input box for answer only. How can I set it up so user can also set their recovery question if this is the first time?

What I see is this:

What I need to see is this:
if user has not set the recovery question, ask user to create it, then update password:

Thanks!


#2

Hi @hapisup! Sorry for the delay.

We don’t allow users to set a recovery question during recovery time, for security reasons. The question and answer must be set beforehand.

How are users registering for your application? Are they self-registering, being imported, or something else?

One option, depending on how strict your security stance is, would be to turn off recovery questions entirely. That would mean that anyone with the email link could change the password.