I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords.
The problem is I am trying to implement my own custom password reset.
This is what I am doing currently:
User requests password reset
A custom token is generated (has a timer to be deleted after 10 minutes)
An email is sent with a http(s) POST request to post the token id
My application checks if the token id exists
If true, the user is redirected a webpage where they can reset their password
User clicks submit and their new password is posted using http(s) POST
My server can then safely process and set the new password
First off, is it a problem using an initial http(s) post request with the token id to request a password reset? I know if anyone got hold of this physical link while it was active (within 10 minutes) they could change a users password then login.
Second, when I make another http(s) POST request with the new user password, is method this "decently" secure to and safe practice? Because again if someone could somehow intercept the request they could gain access to the users "new" password?
My password reset doesn't need to be perfect, however I want it to be good practice.
Is there anything serious I am doing wrong / making a mistake and if so what do I need to be to fix it?
*Note I use "http(s)" with (s) in brackets because I haven't brought an SSL yet.