I have a login system created in PHP. It currently doesn't have the "forgot password" feature and I would like to implement the feature.
For this I'm planning to do the following:
- When user submits the form with email on "forgot password" page, an email with a unique token of 50 characters is sent.
- The unique key generated is stored in the session cookie using
$_SESSION['forgotPassToken'] = "tokenof50chars";
- The page asks to type the unique token sent to the user's email inbox.
- When the token is entered, code checks if the token on session and the one entered is the same.
- If same, a new session variable name
forgotPassVerifiedis generated and is redirected to a page where user can enter the new password and submit.
- Password is changed and the session is destroyed. Pages asks user to login with new password.
My question: Is it safe to store the randomly generated token in the PHP session or should I use database?
I don't like to do this in database. That's why I'm approaching this session way.
Here are the reasons why I'm not using database for storing tokens:
- Some users (crackers) just submits the form with an email. They don't check the inbox.
- Save database space
- Reduce usage of executing SQL queries.