I've a question regarding a forgotten password flow. Basically I'm sending the password reset token out-of-band to the user, and then the user sends it back with the first request via querystring, I validate it and check it's expiry and then I delete it, and generate and store (hashed) a new one which I return to the user with the new password/confirm password UI, where he'll input the new password. (of course, I also delete the second token after the password is changed)
And I'm curious if it's too excessive to generate a new token to send back with the UI. Or should I just send the old one back again, and then check again when it's sent back with the new password.
Thanks, and have a good one.