Password-reset mechanism based on Sessions

Question

I was wondering if the following password-reset mechanism is safe:

The user clicks on 'I forgot my password' and enters his mail. After he has submitted, a security_token gets generated. This token consists of the following combination: entered_email + timestamp + a randomized string of 15 truly random bytes. The randomized string is different for each reset.

This security token gets saved in a session-variable.

If the entered email-address exists in the database, we retrieve the ID of that user and also put that in a separate session-variable. Than a mail is sent to that mail-adres.

The mail contains a URL containing the security token. Like https://example.com/reset.php?key=THAT_RANDOM_SECURITY_TOKEN_THAT_IS_ALSO_SET_IN_SESSION_VAR.

After clicking that URL in the mail there is a check to see if the content of the url-parameter key matches with the security_token in the session variable. If it matches, the user's password gets updated with the new password he has entered. We know which row to update because we also putted the user-id in a session variable.

I think this is save for the following reasons:

1. The secret URL is hard to guess
2. Even if someone intercepts the mail/secret token, he still needs to perform a session_hijack to put the security_token in his session variable.

Answer 1

As you are comparing the token with what you saved in the current browser session, you don't need to use <entered_email + timestamp + random> in the token. Just the random suffices.

So you basically store in the browser session:

• User id to be reset
• Reset token
• Timestamp it was sent or token expiry

When you receive the link, you:

• Allow to reset the given id if the session timestamp shows the token as not expired and and the url token matches the session one
• Delete the session information

So yes, this would be a safe way to let users reset the account password from their email. Be aware that users could close the browser or open the link in a different one, in which case that wouldn't work. You should probably include a note stating that they must open the link in the same browser they requested the reset from.