Intermediate LevelAuthentication & Authorization
How do you design a secure Password Reset token generation and verification flow?
❓ Interview Prompt: Explain password reset token security, SHA-256 database hashing, single-use enforcement, and email enumeration defense.
Password reset endpoints are major targets for account takeover and email enumeration attacks.
Secure Password Reset Flow:
1
Generic Response: Always return "If an account exists, a reset email has been sent" to prevent Email Enumeration.
2
High-Entropy Token: Generate a 256-bit random cryptographic token.
3
Database Storage: Store only the SHA-256 hash of the token with a short expiration TTL (15 minutes max) and 'used: false' flag.
4
Invalidate Previous Tokens: Delete or invalidate all existing reset tokens for that user ID upon issuing a new request.
5
Invalidate Sessions: Upon successful password reset, destroy ALL active user sessions across all devices!
Code Implementation Example
typescript
async function processPasswordResetRequest(email: string) {
const user = await db.users.findByEmail(email);
if (!user) return; // Silent return prevents email enumeration!
// Invalidate old active reset tokens for user
await db.resetTokens.deleteForUser(user.id);
const rawToken = crypto.randomBytes(32).toString('hex');
const tokenHash = crypto.createHash('sha256').update(rawToken).digest('hex');
await db.resetTokens.create({
userId: user.id,
tokenHash,
expiresAt: new Date(Date.now() + 15 * 60 * 1000) // 15 Min TTL
});
await sendResetEmail(email, rawToken);
}💡Generating single-use hashed password reset tokens while preventing email enumeration.
🎯 Interview Key Takeaway
Store SHA-256 hashes of short-lived reset tokens, return generic responses to block email enumeration, and invalidate sessions upon reset.
#Password Reset#Security#Email Enumeration#Tokens#Intermediate
Back to all Authentication & Authorization Questions→