Im implementing a password recovery solution that follows this Generic Framework convention:
My questions is when should the reset token be destroyed. According to the frameowrk, "The reset token should be invalidated as soon as it is used."
Does it mean:
- to destroy as soon as the user lands on the webpage to enter a new password
- to destroy when we call the API to reset it with the new password
First option means the user cannot refresh/hit the page twice because is going to destroy the token in the first landing. Second option allows the user to hit the page as many times as he want because token validation is made upon a new password is provided. Although, we could go further and validate the recovery token when the customer hits the webpage but destroy it only when a new password is provided.
Can you please give me a hand on this?
Note: Link to reset password is provided by email.