To resend verification code, email is not received when sendUserAttributeVerificationCode is called

[hurmain8]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

React Native

Amplify APIs

Authentication

Amplify Version

v6

Amplify Categories

auth

Backend

None

Environment information

Details

# Put output below this line

Describe the bug

1. email received first time when updateUserAttributes is used.
2. to resend the code, I use sendUserAttributeVerificationCode but can't receive any code

Expected behavior

• sendUserAttributeVerificationCode should be working and email should be received

Reproduction steps

1. use signup method to register as anonymous user i.e username=uuid.v4() and password=uuid.v4()
2. use updateUserAttributes method
3. use updatePassword to update new password entered by user
4. At this time, email is received which is fine.
5. To resend verification code, call sendUserAttributeVerificationCode but can't receive any email

Code Snippet

import {  signUp, signIn, updatePassword, updateUserAttributes, sendUserAttributeVerificationCode } from "aws-amplify/auth"


1. register as anonymous user:

generateAnonymousUserCredentials() {
      const username = uuidToString(uuid.v4())
      const password = uuidToString(uuid.v4()).slice(0, 10)
     const signUpResult: SignUpOutput = yield signUp({
            username,
            password,
          })

      yield signIn({ username, password })
    
}

2. after using updateAttributes, I get email which is fine.
const updateAttributes = async (values) =>{ 
  const userAttributes = {
                  family_name: values.lastName,
                  given_name: values.firstName,
                  email: values.email,
             
                }
await updateUserAttributes({ userAttributes })
 await updatePassword({
                  oldPassword: values.oldPassword,
                  newPassword: values.password,
                })
}

3. After 1 minute, I try to use resendCode to get verification code but I can't receive it.

const resendCode = async () => {
await sendUserAttributeVerificationCode({
          userAttributeKey:"email",
        })

}

Log output

Details

// Put your logs below this line

1. after using after using updateAttributes, got following response and also got email:

{
  "CodeDeliveryDetailsList": [
    {
      "AttributeName": "email",
      "DeliveryMedium": "EMAIL",
      "Destination": "h***@g***"
    }
  ]
}

2. after using sendUserAttributeVerificationCode, got following response but no email:

{
  "CodeDeliveryDetails": {
    "AttributeName": "email",
    "DeliveryMedium": "EMAIL",
    "Destination": "h***@g***"
  }
}

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

I have also looked into https://github.com/aws-amplify/amplify-js/issues/13432 that is already reported but I still can't find any solution.

[bobbor]

hey @hurmain8

thanks for reaching out.

Just to make sure, that I understood you correctly, you (let your users) change the email and get a confirmation-code to the new email, but when resending the code it is not delivered, right?

When updating userAttributes using updateUserAttributes cognito is invoked to send out the code. a code is only send, when the attribute requires verification.

Unfortunately, there is this little sentence in the docs describing the behaviour for those attributes.

Your user can sign in and receive messages with the original attribute value until they verify the new value.

which means the email is not updated until confirmed (so the original email address).
this means sendUserAttributeVerificationCode will send an email to the that email address, not the newer unconfirmed one.

I'd suggest you to try this as a re-send mechanic:

const resendCode = async email => {
  await updateUserAttributes({
    userAttributes: {
      email
    }
  })
}

small issue here is, that it requires you to somehow store the email address.

please let me know if this helps you.

Cheers Philipp

[hurmain8]

@bobbor Thanks for quick response.
No I don't change the email at all.
Basically, my onboarding flow is that

1. I try to signup a user with random credentials (username and password as uuids) using:
   signUp({
   username,
   password,
   })

2. signIn with same credentials.

3. I try to add email using updateUserAttributes({userAttributes: {email: userEmail}}). I receive the email at this time.

4. change the password using updatePassword.

5. Now, If I try to resend the code using sendUserAttributeVerificationCode, I can't receive the email.

Additionally, I have just tested out with following. Request is sent with response 200 but still couldn't receive the email.

 await updateUserAttributes({
    userAttributes: {
      email
    }
  })

Please let me know if I'm missing something here or my onboarding flow is not correctly setup.

[bobbor]

hey @hurmain8

so, according to Cognito docs, calling updateUserAttributes({userAttributes: {email: userEmail}}) will send out an email to the new email to confirm it (if verification is required)

This confirmation Email contains a code, which has to be provided (including the username IIRC) to confirmUserAttribute and then the email should be changed.

when using sendUserAttributeVerificationCode you'd be verifying an attribute by key to its current value. and the user triggering the change needs to be logged in and (I think, don't quote me on that ;) ) it needs to be their attribute. - so noone can send a code for anybody else but themselves.

---

now what I would be interested in, is the output/return values of your function calls. maybe they give some indicators to which email they try to send to. and which step fails or passes.
Only request I have is unique enough emails that after scrambling (j***@e***) they are still recognizable as the correct email.

And if all is correct, the issue might not be with Amplify but rather with Cognito.

import {  signUp, signIn, updatePassword, updateUserAttributes, sendUserAttributeVerificationCode } from "aws-amplify/auth"

// 1. register as anonymous user:

const generateAnonymousUserCredentials = () => {
  const username = uuidToString(uuid.v4())
  const password = uuidToString(uuid.v4()).slice(0, 10)
  try {
    const signUpResult = await signUp({
      username,
      password,
    });
    // DEBUG
    console.log('signUpResult', signUpResult)
  } catch(e) {
    // DEBUG
    console.error('signUpResult error', e)
  }
  
  try {
    const signInResult = await signIn({ username, password })
    // DEBUG
    console.log('signInResult', signInResult)
  } catch (e) {
    // DEBUG
    console.log('signInResult error', e)
  }
}

// 2. after using updateAttributes, I get email which is fine.

const updateAttributes = async (values) => { 
  const userAttributes = {
    family_name: values.lastName,
    given_name: values.firstName,
    email: values.email
  }
  try {
    const updateResult = await updateUserAttributes({ userAttributes });
    // DEBUG
    console.log('updateResult', updateResult)
  } catch(e) {
    // DEBUG
    console.log('updateResult error', e)
  }

  try {
    const updatePasswordResult = await updatePassword({
      oldPassword: values.oldPassword,
      newPassword: values.password,
    });
    // DEBUG
    console.log('updatePasswordResult', updatePasswordResult)
  } catch(e) {
    // DEBUG
    console.log('updatePasswordResult error', e)
  }
}

// 3. After 1 minute, I try to use resendCode to get verification code but I can't receive it.

const resendCode = async () => {
  try {
    const sendResult = await sendUserAttributeVerificationCode({
      userAttributeKey:"email",
    });
    // DEBUG
    console.log('sendResult', sendResult)
  } catch(e) {
    // DEBUG
    console.log('sendResult error', e)
  }
}