How to remove the "hint" query parameter during AAD B2C password reset flow?

Question

We have set up the password reset exchange as instructed in the docs and are trying to remove the hint query parameter that gets added to the URL when clicking the forgot password link. We do not want it as it is an info leak. Someone else asked a similar question, but they wanted the opposite of what we want and discovered the query param already exists. How do we remove it?

Answer 1

Hi Batman,

Thank you for posting in the Q&A Forums.

1. Understanding the role of the hint parameter

The hint parameter is designed by Azure AD B2C for user experience purposes and allows the user's identifier (e.g., username or email) to be pre-populated via a URL before the user begins the password reset process. However, this can also pose a security risk as it may reveal the user's personal information.

2. Customizing the password reset policy

To remove the hint parameter, you need to customize the password reset policy for Azure AD B2C. This usually involves modifying or creating custom User Journeys and Technical Profiles. However, removing the hint parameter from the URL directly through the Azure AD B2C configuration interface or policy file may not be directly supported.

3. Modifying the password reset link

A more practical approach is to control the process of generating password reset links. Make sure that you do not include the hint parameter when generating these links. This is usually done on the back end of your application or web service, where you can adjust the logic to exclude this parameter.

4. Use security best practices

Minimize information leakage: Ensure that the principle of least privilege is followed in any part of your application and that only necessary user information is requested and transmitted.

Use HTTPS: Ensure that all communication with Azure AD B2C is done over HTTPS to protect the confidentiality and integrity of data.

User education: Educate users not to share password reset links or any URLs containing personal information with untrusted third parties.

Best regards

NeuviJ

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hi @Batman (haha) , the id_token_hint query parameter is added to the password reset URL to help prevent phishing attacks. It's used to pass the user's identity to the password reset policy so that the policy can verify that the user is who they claim to be. If you don't want it though, you should be able to remove it with a custom policy. Please try the following for me and let me know if it works:

1. Create a copy of the built-in PasswordReset policy.
2. In the TrustFrameworkExtensions.xml file of the copied policy, remove the OutputClaim element that outputs the id_token_hint claim: <OutputClaim ClaimTypeReferenceId="id_token_hint" PartnerClaimType="id_token_hint" />

If this doesn't work, I can investigate further. Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James