Php, update password without login?

Question

I have a new website. And the following is my scenario:

I will send an email to 5 people (numbers not important), inside the email, i will include a link for them to click:

www.domain.com/[email protected]&key=abc...xyz

They key are randomly generated using salt and sha1 in php. Upon click the link in their email, can I directly let them access the update profile page?? Or do I need to ask them login again?

If I directly let them access the update profile page, what are the security things I need to take care? I know the use of login, can store session, but, the thing is, they click the link from their email, and I think its quite private and safe.

The only security flaw I can think of is: the hacker can magically memorize the "key" (which is about 60++ characters), and then type in browser URL: www.domain.com/[email protected]&key=abc...xyz.

If the hackers can do that, then I am done. My users account will be hacked.

Is there anything else that hacker can hack? Just update profile page only.

Btw, if they already update their profile, should I remove the "key" in database??

I am using php and mysql

Answer 1

A password reset email should have a one-time use - store an opaque token in your database, send it in the email, and only allow it to be used once.

Answer 2

I agree with Paul, but for profile updating I suggest to do it after login. You can also display and memorize the ip address of client when he resets his password.

Answer 3

Typical practice is to require a user to change their password when they are sent a 'Forgot Password' email, and then make them log in before they can change anything.

A recent implementation of a password email that I created worked as follows:

• Create an array containing the id of the user, and the current timestamp.
• Serialize and then encrypt the resulting string (using a symmetric key, which is stored on your server).
• Put that encrypted string in a url parameter (my advice is to base64_encode the data twice in order to ensure you don't get bad characters in the url), and then send it to them in an email.
• When someone clicks on the link in their email, first check that the parameter decrypts properly (meaning it's valid), and then deserialize the data structure. You now check that original timestamp. If too much time has passed since that point, reject the forgotten password url as too old.
• If the url is valid, and recent enough, take them to a 'reset password' page.