Password Reset URL strategy

Question

Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend developers.

Although that's not the point of the question, i appose the flow for a better understanding of the reader.

• Request reset for an email (frontend)
• Whether the given email is present or not send response OK (backend)
• Generate a random reset-hash (if one is not present & not expired, to avoid spam) (backend)
• Send the reset link @ user's email (backend)
• Redirect to a URL with the password reset form (frontend)

And there is the point that the question kicks in.

What information needs to be send (with the URL) to the frontend, so that the frontend knows what user identifier needs to be sent back?

My first thought is that frontend needs to send back the new user's password alongside the hash from the email, so that server gets the user's info from matching hash with reset-request. Even if somebody bruteforces the hashes, and finds out a password-reset page he will never know for which user he is changing the password for.

Am i missing something here or this is the most secure way to handle the reset-URL, given that 2-factor authentication functionality is not present?

Is this how large corps handle the reset-link functionality?

Thanks in advance!

Answer 1

What information needs to be sent (with the URL) to the frontend, so that the frontend knows what user identifier needs to be sent back?

Don't send any information to the front end if possible. Some sites fetch the user name to show greetings but I would avoid that too.

---

So the complete workflow will be,

• Request reset for an email (frontend)
• Whether the given email is present or not send response OK (backend)
• Generate a random reset-hash (if one is not present & not expired, to avoid spam) (backend)
• Send the reset link @ user's email (backend)

• In the landing page from the email link, obtain the hash from the URL and check if the hash is valid
• Redirect to an error page in case of expiry, invalid link, etc... (Kindly don't fake an OK response here as you did while obtaining email. Here errors can occur as usually email provider re-route the links through their server and some may remove parameters)
• Else, redirect to reset-form, obtain the password from the user and send it along with hash to the backend.
• Use the hash to match the user and update the new password.
• Show a success screen to the user, send an email and redirect them to the login page.