Password Reset Flow (Token-Based, Secure Design)

A password reset flow should never email a password. It should email a one-time token link.

Standard flow

flowchart TD
  A[User requests reset] --> B[Server creates token + expiry]
  B --> C[Email reset link with token]
  C --> D[User opens link]
  D --> E[Server validates token]
  E --> F[User sets new password]
  F --> G[Token invalidated]

Table example: password_resets

CREATE TABLE password_resets (
  id INT AUTO_INCREMENT PRIMARY KEY,
  user_id INT NOT NULL,
  token_hash VARCHAR(255) NOT NULL,
  expires_at DATETIME NOT NULL,
  used_at DATETIME NULL
);

Key best practice

Store token hash, not token itself.

• create token
• store hash(token)
• email raw token
• compare hashes when user returns

Next: Middleware-style routing, build cleaner APIs and controllers.