I'm trying to figure out best practices for working with password reset tokens.
Say a user initiates the password reset process and the are emailed the reset token and we store a hashed copy in the database. The token is time stamped in our DB and will be considered expired in, say, 24 hours.
Now consider two scenarios for what could happen next:
1) The user thinks he didn't get the email, tries to reset again. Should we allow him to generate another token? If we do, should we delete the old token immediately? (They all will be invalid from 24 hours after the issue
datetime anyway...) I think it would minimize support calls if we allow a little flexibility as long as they're expiring anyway. Is there an attack type I'm not considering here?
2) The user received the email and clicks the reset link but doesn't complete the reset form. When should I delete the reset token? Only after a successful reset--the user can click the link again and again during the 24 hours and it only becomes invalid once he finally resets the password. Or should I delete the token as soon as he clicks the link for some security concern? (all of this occurs before expiration)