I am implementing a web app with reset password flow. Here is what I've done to try to make it secure.

  1. Put in the email address in forgotten password form.
  2. Regardless of whether the customer exists, the application reports an email sent, this avoids giving away the existence of an email address.
  3. I generate a secure random string, then bcrypt it and use that as an access token with validity of 1 day.
  4. Customer clicks link back which has a token parameter, I check the customer table and allow them onto the reset password form if the token is valid.
  5. In that form I put the token value, not the id of the customer being reset which avoids exposing the id.

Now first question is, is this secure enough?

But my main question is related to Hibernate and parameters - my query is like "Select c from customer where c.token = ?1 and c.activeDate > DATe_NOW". I pass in the raw token parameter value.

In JPA/Hibernate or JPQL, is there any risk of an injection attack by modifying the token parameter when I'm using positional parameters like this in the query?

  • The token you provide, is it 1 use only or is it available for 1 day, use it as much as you like to? – sir_k Jul 23 '15 at 13:17
  • It will be 1 use, I'll clear it once the password has been reset. – Richard G Jul 23 '15 at 14:00

First, I don't see any benefit of encrypting the random string in step 3. (I don't see a difference between trying to guess a random string and an encrypted random string- which could be considered just another random string.) But I don't see how this hurts either...

For your first question, is your algorithm secure enough? That depends on what sort of data/functionality you are protecting. Your method simply makes the assumption that if you have access to the email address associated with the account, then you should be allowed to reset the password, and it looks like you are accomplishing this in a well thought out and reasonably secure manner. If your site has financial transactions or health records, you may want to consider adding an additional verification step; security questions are the most common way to do this. If your site has government secrets or nuclear codes, you'll probably want to force people to reset their password in person...

As for your second question, with parameterized SQL you are protected from sql injection. It doesn't really matter what the token is or if someone gets fancy with putting 'DROP TABLE' in their token string. It will either match your expected token or it won't.

As an aside, I suppose even if you left it open for SQL injection to occur, the fact that you're encrypting/decrypting the token would make it pretty difficult for someone to inject meaningful sql code unless they knew you were doing this, and how you were doing it. So even though I started off by saying the encryption isn't needed, I guess it could help as a "security by obscurity" if you had no protection against sql injection.


I'm not quite sure what you are referring to when you say you are using "Hibernate" (NHibernate?)

Either way - usually when you see the pattern of replacing a parameter with a ? it suggests that you are working with a parameterized query. If it is using parameterized queries then you will be protected from SQL Injection in your situation.

If you can clarify which technology you are using I can give a clearer answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.