Password Recovery Implementation on Website
Password recovery is a standard Forgot Password flow. User enters email, receives reset link via email, sets new password. Implemented via token with short TTL, stored as hash in database.
Flow
- POST /forgot-password — create token, send email
- GET /reset-password?token=...&email=... — form for new password
- POST /reset-password — verify token, change password, delete token
Laravel Password Broker
Laravel includes built-in password recovery mechanism.
Token Storage
Laravel stores bcrypt hash of token in table:
| token (bcrypt) | created_at | |
|---|---|---|
| [email protected] | y0$... | 2024-01-15 10:00 |
Token is valid for 60 minutes (parameter in config/auth.php). Stale records are deleted by command which should be added to cron.
Security
- Same response for existing and non-existing email — don't reveal account existence
- Rate limiting: max 3 requests per hour per email or IP
- After token use, delete immediately
- On password change, invalidate all active user sessions
Custom Email Template
Link in email is constructed as signed URL with TTL.
Timeline
1–2 working days including custom email template and rate limiting.