CODEWITHSUNDEEP
pythonflaskflask-security
Aleksandr Zakharov
Aleksandr Zakharov

Reputation: 384

Where does flask store token for password recovery?

I need to provide password recovery token in order to test it's functionality with integration test. But I can't trace the place its stored.

Upvotes: 0

Views: 89

Answers (1)

deceze
deceze

Reputation: 522510

Apparently it doesn't. It hashes the user's current password [hash] and their id and sends that as token. Which is entirely reasonable, since that's already user-specific information stored in the database, no need to generate yet another token. And it will even invalidate itself once the password has been changed. I'd probably add a timestamp somewhere in there though so the link isn't valid forever.

Upvotes: 2

Related Questions