I was wondering if the following password-reset mechanism is safe:
The user clicks on 'I forgot my password' and enters his mail. After he has submitted, a security_token gets generated. This token consists of the following combination: entered_email + timestamp + a randomized string of 15 truly random bytes. The randomized string is different for each reset.
This security token gets saved in a session-variable.
If the entered email-address exists in the database, we retrieve the ID of that user and also put that in a separate session-variable. Than a mail is sent to that mail-adres.
The mail contains a URL containing the security token. Like
After clicking that URL in the mail there is a check to see if the content of the url-parameter
key matches with the security_token in the session variable. If it matches, the user's password gets updated with the new password he has entered. We know which row to update because we also putted the user-id in a session variable.
I think this is save for the following reasons:
- The secret URL is hard to guess
- Even if someone intercepts the mail/secret token, he still needs to perform a session_hijack to put the security_token in his session variable.