php reset password links

Question

I have create a user login system.

In my forgot password page. I use php email to user. User will receive an email with a link

link-

[email protected]&confirm_code=uefu8878ef...

user can click this links to the access the reset_password page.

However this is using GET, which is mean anyone can check browser history to access this page and reset the password.

any suggestion?

John Conde · Accepted Answer · 2013-04-02 14:37:31Z

6

After the link is used mark the confirmation code as used/invalid so it cannot be used again.

answered Apr 2, 2013 at 14:37

John Conde

220k100 gold badges464 silver badges504 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Trenton Trama Over a year ago

In addition, when you create the code, add an expiration date. Don't let it sit there forever if it's not used.

Laurent S. Over a year ago

and I would also suggest using post. In addition of the solution proposed here above

chien pin wang Over a year ago

i think i will use sha1 on email too, and if user click the links DELETE the code from db immediately

ka_lin Over a year ago

@chien pin wang: regenerate another token based on a random number :-)

Adrian Over a year ago

You can't have a post link from an email, but the rest is correct: make a random hash each time, link it to that account specifically, dump it once it's used, and give it an expiration date (24-48 hours at the most).

Phil · Accepted Answer · 2013-04-02 14:39:31Z

1

If you want to hide the email aswell, generate a custom token to do that. The token must be unique, and keep it linked with the email adress in your database. Delete it when it has been used (or mark it used).

answered Apr 2, 2013 at 14:39

Phil

2942 silver badges11 bronze badges

Comments

Last Breath · Accepted Answer · 2013-04-02 14:48:48Z

0

Save your confirmation code in the database and make a link between it and the email address and give it a time so it will expires after the time expire and now each time this page is requested look first of all if the confirmation_code related to this email and if it is check the time of use with the time inside the database then if it is not expired mark it as authorized then process the request else delete it records at all

Then about expiry to be more secure i think that if you set the expiry date to 1 hour it will make sense . Hope this will help :)

answered Apr 2, 2013 at 14:48

Last Breath

5302 silver badges12 bronze badges

Collectives™ on Stack Overflow

php reset password links

3 Answers 3

5 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

5 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related