If a previously registered user clicks on the password reset button during login, I want to send them an email with a reset password link.
I have three queries:
How to add an expiry date to the URL link?
How to structure the URL? I previously had not hashed passwords and sent a "click here" link with
https://www.example.com/?login&EMAIL=website&PASSWORD=text-password&LOGIN=1&PATH=2
Now I have hashed all passwords how do I structure the URL? Do i still include the
email&hashedpassword
as above or hash the entire URL?I noticed with a well known UK site that when my wife requested my password to be reset I want sent the reset URL, but because one of my email addresses is auto-forwarded to my wife's email, she was able to reset my password and log into my account. Obviously i'm not too bothered in this instance, however I know many people who auto-forward their personal emails to work email addresses so technically someone could use a password reset URL to hack an account.
Is there a way round this...for example when you send the password reset URL, it only "works" if clicked from the mail client with that email address?