{"action":"opened","issue":{"url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/5418","labels_url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/5418/labels{/name}","comments_url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/5418/comments","events_url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/5418/events","html_url":"https://github.com/OrchardCMS/Orchard/issues/5418","id":90661155,"number":5418,"title":"Request Lost Password not working with Anonymous Access turned off","user":{"login":"ivyexcellence","id":12548238,"avatar_url":"https://avatars.githubusercontent.com/u/12548238?v=3","gravatar_id":"","url":"https://api.github.com/users/ivyexcellence","html_url":"https://github.com/ivyexcellence","followers_url":"https://api.github.com/users/ivyexcellence/followers","following_url":"https://api.github.com/users/ivyexcellence/following{/other_user}","gists_url":"https://api.github.com/users/ivyexcellence/gists{/gist_id}","starred_url":"https://api.github.com/users/ivyexcellence/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ivyexcellence/subscriptions","organizations_url":"https://api.github.com/users/ivyexcellence/orgs","repos_url":"https://api.github.com/users/ivyexcellence/repos","events_url":"https://api.github.com/users/ivyexcellence/events{/privacy}","received_events_url":"https://api.github.com/users/ivyexcellence/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-06-24T12:26:24Z","updated_at":"2015-06-24T12:26:24Z","closed_at":null,"body":"We required anonymous access turned off on a Staging server so we turned off the permission \"Access site front-end\" for the role \"Anonymous\" and it worked pretty fine.\r\n\r\nBut with this, users are no more able to change their passwords.\r\n\r\nWith \"Request Lost Password\" link users are able to submit request for lost password. They get the email with a link to reset the password. But this link takes them back to the Access Denied/Login page:\r\n\r\nWe dig it deep and found out that following Actions in the \"AccountController\" of Orchard.Users module need to have [AlwaysAccessible] attribute in order for it to work fine.\r\n\r\n```\r\npublic ActionResult LostPassword(string nonce) \r\n```\r\n```\r\n[HttpPost]\r\n[ValidateInput(false)]\r\npublic ActionResult LostPassword(string nonce, string newPassword, string confirmPassword)\r\n```\r\n```\r\npublic ActionResult ChangePasswordSuccess()\r\n```\r\n"}}