How long should a password reset token remain valid?
The aim should be that a reset token is not guessable in the given valid time. So for instance if your reset token is 5 characters long, only digits and your server is capable of answering to 100 requests per second without rate limiting, 15 minutes is likely too long. Just think about the possible attack:
How does a stateless password reset token work?
In principle, a stateless password reset token is very similar to a stateless session cookie. All the state information is stored in the token itself, and it’s combined with a secret so it’s not possible to generate the token without also knowing the secret. The devil is in the detail. The naive way to create the token would look something like:
Do you need to hash password reset tokens?
Yes, you should hash password reset tokens, exactly for the reasons you mentioned. users notice when their passwords are changed, but not when their passwords are cracked, and can thus take steps to limit the damage (change password and other sensitive data, etc).
How to create password reset tokens for etleap?
The devil is in the detail. The naive way to create the token would look something like: user + ” ” + expiration time + ” ” + hash (user + expiration time + secret) To verify the token, all we need to do is: check that the token is not expired compute the hash and make sure that it matches
Can a randomly generated password token be used after a password reset?
Of course, by all means, once a user’s password has been reset, the randomly-generated token should no longer be valid. Point taken about how a compromise of the email account that is receiving the token negates some of the benefit of expiring the token.
Is it good to have password reset links that don’t expire?
It is a good idea that the password reset token expires and that its onetime use only. However, this is not as a big of a concern as storing these tokens in plain text. The biggest reason to have the token expire is to make it more difficult for the attacker to guess this value.