javascript - res.redirect not working after the page is rendered with data -

i have simple functionality of forget password, when user requests change in password recieves email token , email on clicking of redirected page take new passwords.

what when click on link in email , server gets request , function take data out of link renders page data (using res.render) , should redirect rendered page.

the problem facing when click on link getting data , page rendered can't let res.redirect() work.

my link looks

http://localhost:3000/api/resetpassword?_csrf=ab8aa6a41567f817330e3e0a214725f8b2f88b487d5bef16f162e033c6a63dc41933511ddb79cb44ca049f472b3e0c593dbbaf&email=dummyemail%2540dumyurl.ca 

and request on server using app.get().

app.get('/api/resetpassword', admin.resetpasswordpage); 

and rendering , redirecting function looks this;

resetpasswordpage: function (req, res, next) {     req.query.email = decodeuricomponent(req.query.email) ;     res.render('resetpassword', {         email: req.query.email,         csrf : req.query._csrf,      }, function (err, html) {         console.log("testing html ", html);         if (!err)         res.redirect("/resetpassword");     }); } 

rendering successful getting complete html of page in html parameter, question how redirect page. page made in ejs , in views folder.

it sounds want flow:

1. user clicks link /api/resetpassword...
2. express runs resetpasswordpage function
3. resetpasswordpage responds reset password form html page, pre-filled out based on query parameters
4. i think @ point don't url in browser address bar, why think need redirect. need query string parameters, , if redirect /resetpassword, you'll lose them. either have live url (which recommend it's simplest) or rely on session state , session cookie. however, marking session passwordresetok=true exposes whole bunch of csrf attacks _csrf query string parameter there prevent.
5. you don't need redirect here, browser has form. next step user fill out form , submit <form method="post" action="/resetpassword">
6. browser post /resetpassword
7. express routes function changes password , either sends success page or redirects home page or whatever

so long story short think need accept url being , don't need redirect in here until after password reset operation completes.