I am implementing a web app with reset password flow. Here is what I've done to try to make it secure.
- Put in the email address in forgotten password form.
- Regardless of whether the customer exists, the application reports an email sent, this avoids giving away the existence of an email address.
- I generate a secure random string, then bcrypt it and use that as an access token with validity of 1 day.
- Customer clicks link back which has a token parameter, I check the customer table and allow them onto the reset password form if the token is valid.
- In that form I put the token value, not the id of the customer being reset which avoids exposing the id.
Now first question is, is this secure enough?
But my main question is related to Hibernate and parameters - my query is like "Select c from customer where c.token = ?1 and c.activeDate > DATe_NOW". I pass in the raw token parameter value.
In JPA/Hibernate or JPQL, is there any risk of an injection attack by modifying the token parameter when I'm using positional parameters like this in the query?