A cosmetic bug was reported in the Invites account creation screen where the password field is shown as “optional”. philipp2 found this issue in Discourse version 2.8.0.beta7 and it occurs when creating an account over invitation links.
IAmGav pointed out that the red star next to the password field indicates it’s required, but the hint text says it’s optional. IAmGav also found that the issue exists in both English and German locales.
simon explained that setting a password when initially accepting an invite is actually optional, but it’s more straightforward to set it at that time. The current UI is confusing, and it might be better to control this with a site setting.
tobiaseigen suggested that the invite acceptance form should operate like the regular signup form, which requires passwords. Jagster agreed that this is a UI/UX issue, as users may not know they can log in later with a link sent to their email.
The bug is just cosmetic. It doesn’t change anything at the account creation process. Passwords are of course necessary for account creation, and account creation is possible. But it is confusing for users to see the password as “optional”.
The bug only occurs when creating an account over invitation links.
Reproducible steps:
create invitation
open invitation link
erroneous “password: optional” shows everytime on all platforms / browsers, with every invitation link
Setting a password when initially accepting an invite is optional. If an invite is accepted without filling in the password field, the user will need to set a password after they log out and log back into the site.
I think that for almost all cases, setting a password when accepting an invite is more straightforward than setting the password at a later time. For that reason, I’m not sure that the password field should actually be optional. Possibly this is something that could be controlled by a site setting.
The current UI is confusing. The field is optional, but the star next to the password field name is used to mark required fields. If the field is to remain optional, the star should probably be removed from the password field on the accept-invite page.
This precise issue came up again recently. Thanks for @philipp2 for reporting it!
If you are invited by email to a Discourse site, you can accept the invitation by clicking the invite link. You are then allowed to set up your account without having to specify a password. Because your email address already known, you can always log in later with a link sent to your email, add a password, or use social login if it’s set up on the site. In this case everything works perfectly as it always has.
With recent changes to the invite system, we now allow the creation of invite links as well, which can then be copied and shared outside Discourse. This adds the need to require email addresses to be confirmed before invitees log in and get access to discussions. I’m not sure why, but in this case if you complete the form without setting a password, you get a different confirmation email that sends you to a link that requires you to set your password before logging in.
The solution here methinks is to have the invite acceptance form always operate just like the regular signup form, which as the OP shows in screenshots requires passwords. We could then remove the functionality that sends an alternate welcome email with password reset instructions and link.
You know that. I know that. But without deeper knowledge of Discourse an invited user doesn’t know that. Just and only because using email like SSO is quite rare solution. So, this is not a bug, this is UI/UX-issue and is in right category
