Fix invalidating recovery code (#902)

wso2-extensions · Jan 16, 2025 · 84f94ab · 84f94ab
1 parent 8420b25
commit 84f94ab
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/...a/org/wso2/carbon/identity/recovery/internal/service/impl/UserAccountRecoveryManager.java b/...a/org/wso2/carbon/identity/recovery/internal/service/impl/UserAccountRecoveryManager.java
@@ -172,8 +172,13 @@ public RecoveryChannelInfoDTO retrieveUsersRecoveryInformationForUsername(Map<St
                         user, recoveryScenario, RecoverySteps.RESEND_CONFIRMATION_CODE);
 
                 notificationChannelList = getNotificationChannelListForRecovery(notificationChannels);
-                recoveryCode = UUID.randomUUID().toString();
                 recoveryFlowId = UUID.randomUUID().toString();
+                // Skip recovery code generation for question based recovery as it is not required.
+                if (StringUtils.equals(QUESTION_BASED_PWD_RECOVERY.name(), recoveryScenario.name())) {
+                    return buildUserRecoveryInformationResponseDTO(username, recoveryFlowId, null,
+                            notificationChannelDTOS);
+                }
+                recoveryCode = UUID.randomUUID().toString();
 
                 if (Utils.reIssueExistingConfirmationCode(recoveryDataDO,
                         NotificationChannels.EMAIL_CHANNEL.getChannelType())) {