# Password reset email should send IP info
**URL:** https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492
**Category:** Feature
**Created:** [August 4, 2017, 11:58pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492 "2017-08-04T23:58:22Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@pain](https://meta.discourse.org/u/pain)
#### Post date: [August 4, 2017, 11:58pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/1 "2017-08-04T23:58:22Z")
is there a way to make it so that when a user requests a password reset, it sends the ip in the email as well?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 5, 2017, 12:00am UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/2 "2017-08-05T00:00:39Z")
For what purpose? Can you cite examples? Is this a security concern issue?
---
### Author:  [@pain](https://meta.discourse.org/u/pain)
#### Post date: [August 5, 2017, 12:04am UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/3 "2017-08-05T00:04:16Z")
for security reasons, users can do it for spammy purpose, so if someone’s doing it to spam person can report it or something or if its an admin account, he and or she can block ip
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [August 5, 2017, 12:30am UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/4 "2017-08-05T00:30:17Z")
I’ve seen that sort of thing before. The wiki associated with Nextthing’s CHIP computer did it for me:
```plaintext
Someone, probably you, from IP address 10.0.0.70,
has registered an account "Elijah" with this email address on www.chip-community.org.
To confirm that this account really does belong to you and activate
email features on www.chip-community.org, open this link in your browser:
...
```
Complete with that not-useful IP address.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 5, 2017, 1:30am UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/5 "2017-08-05T01:30:25Z")
Couple different ways to approach this..
```
Here are the details of the sign-in attempt:
Thursday, July 07/20/17 at 17:03 MST
Account: name@example.com
Location: US
IP Address: 12.34.56.7
Operating system: Windows 10 64-bit
Browser: Chrome
```
and
---
### Author:  [@pain](https://meta.discourse.org/u/pain)
#### Post date: [August 5, 2017, 1:33am UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/6 "2017-08-05T01:33:49Z")
so how do i set that up then?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [August 11, 2017, 5:29pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/7 "2017-08-11T17:29:15Z")
You can not set this up, it would require changes to Discourse. I think we kind of support at least allowing this optionally.
---
### Author:  [@pain](https://meta.discourse.org/u/pain)
#### Post date: [August 11, 2017, 9:07pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/8 "2017-08-11T21:07:34Z")
well if you guys could implement this in an update that’d be great, that way users can use it and if their account is breached or something, they can resolve it and its also good for admins/mods
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [August 11, 2017, 9:08pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/9 "2017-08-11T21:08:46Z")
Our plate is very very full 🍽
---
### Author:  [@pain](https://meta.discourse.org/u/pain)
#### Post date: [August 11, 2017, 9:18pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/10 "2017-08-11T21:18:45Z")
understandable, but for future updates? like add it to a to-do list? im sure many would enjoy this
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [August 11, 2017, 9:20pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/11 "2017-08-11T21:20:03Z")
Up to @codinghorror if he wants this to be #pr-welcome or plugin material. I am kind of on the fence here.
---
### Author:  [@pain](https://meta.discourse.org/u/pain)
#### Post date: [August 11, 2017, 9:29pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/12 "2017-08-11T21:29:05Z")
ah ok, well if he wants to do it that’d be great, would be great if it’s built into the software and not plugin
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 11, 2017, 10:17pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/13 "2017-08-11T22:17:36Z")
It is not a bad idea @elijah did you want to work on this? V1 can be simple, use any of the existing templates above, or pick your own from (insert how Internet web site does it here).
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [August 12, 2017, 6:17am UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/14 "2017-08-12T06:17:44Z")
Sure, I could look at this shortly.
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [August 18, 2017, 6:21pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/15 "2017-08-18T18:21:02Z")
In my test instance, it is working now, sending messages like this (text part, email part is the md-to-html version):
```markdown
Somebody asked to reset your password on [Discourse](http://my.example.net).
The request came from 142.254.30.0 using "Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0". If it was not you, you can safely ignore this email.
Click the following link to choose a new password:
http://my.example.net/u/password-reset/316696edbc17931b61a7a5edc69be11a
```
People can leave out the {user-agent} param from the message, if they don’t like it. I’m going to test injecting HTML through the UA before I make a pull request. Does anyone think it is worthwhile trying to parse the UA? I worry that’s an ocean of messy heuristics.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 18, 2017, 7:34pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/16 "2017-08-18T19:34:07Z")
Hell no definitely do NOT parse the UA! 😉
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [August 19, 2017, 6:41am UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/17 "2017-08-19T06:41:22Z")
This is a bit harder than I expected. Trying to escape the HTML in a User-Agent at time of save works:
```plaintext
#,
user_agent: "Mozilla/5.0 (<a href="http://exploitme.inv...">
```
Then I pull it out and put it in email. In the text part I get a nice straight-forward:
```html
using "Mozilla/5.0 (<a href="http://exploitme.invalid/">Phishing</a>)
```
And in the HTML part I get:
```html
using “Mozilla/5.0 (Phishing)
```
Why is it talking my disarmed HTML and rearming it?
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [August 20, 2017, 11:52pm UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/18 "2017-08-20T23:52:46Z")
I went with a belt-and-suspenders fix. Drop any `<`, `>`, and ``` in the UA, then wrap the UA in backticks so Markdown will treat it as code.
[https://github.com/discourse/discourse/pull/5069](https://github.com/discourse/discourse/pull/5069)
---
### Author:  [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [August 21, 2017, 12:30am UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/19 "2017-08-21T00:30:13Z")
I was thinking that the country and city should be provided along with the IP address as well. To a non-technical user, showing them a bunch of random digits might not make any sense to them. 💭
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [August 21, 2017, 12:50am UTC](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492/20 "2017-08-21T00:50:06Z")
Is Discourse using a geo-ip library already? I didn’t want to add one just for this.
[Next page](https://meta.discourse.org/t/password-reset-email-should-send-ip-info/67492.md?page=2)