0

I have always seen those "Forgot password" links from web sites that requires some form of user login. Can I get a deeper understanding of how this works? What tools/framework do I need to use because we are thinking of implementing these kinds of "automation". I believe I need a combination of email, OTP etc.

We are currently still in manual mode, i.e by sending password letters through snail mail and I am thinking of revamping our site. thanks

Improve this question

1 Answer 1

Reset to default
3

Password reset mechanisms typically work like this:

  1. The server generates a secret random string (e. g. 16 bytes read from /dev/urandom).
  2. Then the server sends this string to the user, often embedded within a link to a password reset page. A hash of the string is stored in the database for later validation. Usually, the string is only valid within a certain time frame.
  3. When the user clicks on the link, the server checks the transmitted string. If it's valid, the user may change the password.

While this approach is very common, it's obviously far from perfect. A plaintext e-mail may very well end up in the wrong hands, in which case the secret string is compromised. Whether or not this risk is acceptable depends entirely on your application and your specific requirements.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .