Lesson 08 · 11 min
Password reset and one-time tokens
A link in an email is a key to the account. Make it short-lived and single-use.
11 minLesson 8 of 9Practice includedAsk AI on any point
For a password reset, the server generates a random token with a cryptographic generator, stores its hash and expiry in the database, and emails the token itself as a link. When the user follows it, the server hashes the token from the address, finds the record, checks the expiry, changes the password, and deletes the token. Email confirmation and magic-link sign-in work the same way.
Sign in to continue
The rest of this lesson opens after sign up
The first lesson of every course is open without an account. To read on, solve the practice and use Ask, create a free account or log in.