Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend developers.
Although that's not the point of the question, i appose the flow for a better understanding of the reader.
- Request reset for an email (frontend)
- Whether the given email is present or not send response OK (backend)
- Generate a random reset-hash (if one is not present & not expired, to avoid spam) (backend)
- Send the reset link @ user's email (backend)
- Redirect to a URL with the password reset form (frontend)
And there is the point that the question kicks in.
What information needs to be send (with the URL) to the frontend, so that the frontend knows what user identifier needs to be sent back?
My first thought is that frontend needs to send back the new user's password alongside the hash from the email, so that server gets the user's info from matching hash with reset-request. Even if somebody bruteforces the hashes, and finds out a password-reset page he will never know for which user he is changing the password for.
Am i missing something here or this is the most secure way to handle the reset-URL, given that 2-factor authentication functionality is not present?
Is this how large corps handle the reset-link functionality?
Thanks in advance!