I searched for a long time, and never really find any articles or posts that fully explain how a password reset token should be created.
What I know so far:
- It should be random.
- Its hash should be stored in the database.
- It should expire after some time.
What I'm not too sure about:
- Should I use a cryptographic method to create the random token? Is Node's
crypto.randomBytes
enough? - Should I use a cryptographic method (e.g., bcrypt) to hash the token?
- Should I include certain information (i.e., expiry time, UUID, etc.) in the token? If yes, is JWT a good way?
I imagine the whole process would look something like this:
- Create a random token.
- Hash the token and store the hash in the database.
- Send the token in plain text to the client.
- Once it is used, or if it is not used after a certain time limit, delete it from the database.
- When a token in used, check if its hash matches any from the database.
- If matched, allow user to reset password. Otherwise, disallow the process.