How can I 'expire' a change password unique code in a database record?

Question

Hi,

I want to implement a forgot password function in my java web application. I want to implement it like this:

1. User enters their account email address and presses 'forgot password' button
2. App generates a unique code of characters and numbers and sends a link with that as a parameter to the user's email address
3. User clicks the link and they are presented with a form where they can enter their new password

What I want to do is ensure that the link (i.e. the unique code) 'expires' an hour after the user presses the forgot password button so that if an attacker gains access to their email account this link won't work unless they gain access in that first hour.

I don't know how to make the database 'expire' or clear the code for the user's account record. How could I implement this?

Thanks!

Answer 1

You store the date in the database that the unique code was generated. When the user clicks on the link, if it is more than the allowed time since the unique code was generated, you do not let them change the password.

Answer 2

Add a ValidUntil column to the table containing the code and check against that before letting the user change the password.