CODEWITHSUNDEEP
eclipseemaildynamicpasswordsreset
Mwangi Thiga
Mwangi Thiga

Reputation: 1369

Password reset via mail

I am doing a web application using Eclipse EE. I have a module which is supposed to reset user passwords and sends the user (via email) a link to a page where they can reset the password. Any insights please?

Upvotes: 1

Views: 255

Answers (1)

Jan Köhler
Jan Köhler

Reputation: 6030

The main steps would be:

  1. Provide a "forgot password" page where the user can enter her email address
  2. look up the entered address but don't tell the user any details. Don't output a message like "email address not found" as it would allow a malicious user to look up valid email addresses. Better give them a message like "you'll receive a link to reset your password if the entered email address is registered".
  3. Create a strong unique random identifier to associate it to that reset-request. E.g. use a cryptographically RNG provided by the framework and combine it with something unique like e.g. a GUID.
  4. Store that unique identifier along with that reset-request in e.g. a table in your database and put a timestamp to that record. That's important as you'd want the user to be only able to reset her password within a fixed time frame.
  5. Send an email with that unique identifier put as a query parameter in a link to your application. E.g. https://yourapp.com/pwreset/?requestID=7392af1747ce3781
  6. Fetech the requestID parameter at your pwreset-controller and look it up in your database. If the request comes in within a reasonable time frame based on the initial request timestamp, then let the user reset her password.
  7. Delete successful request-records from your database, so that a sent pw reset link can only be used once. And periodically delete expired records.

Use this as a starting point. As I'm no crypto expert, you may one have a look at this approach ;)

Upvotes: 2

Related Questions