Add tip how to create a token without database write. Add tip how to complete a password reset without creating a session at all. #1951
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ps on how to complete a password reset without a limited session. Added suggestion how a password reset mechanism can be constructed to avoid writing to the database (by securely hashing items read from database). This while still fulfilling the requirements that the tokens expire after a time, become invalid after use, are sufficently long to protect against brute-force. The invalidation works by making the current password hash (not current password) an input in generating the reset token. Thus a password change, will lead to another password hash, which means the token generated will be different, thus the previous token becomes invalidated. Another tip added, is that token invalidation should be avoided when the token link is clicked, This because an increasing number of mail providers have started to scan links by "clicking" them. Some security software also does this, by sending the link to a cloud service. This also means the token should not be checked when visiting the token, as it opens up a brute force possibility. Only when a valid password reset (where everything else is OK) should the token be checked if its valid. Thus, the token should ONLY be invalidated or "consumed" when the user actually completes a password reset using the reset link. Also added the suggestion to avoid creating a session for PIN reset method, by having the end user submit everything in one go, meaning, user enters PIN, username, new password and new password again, on the same page. Here its also important to avoid invalidating the PIN if the password doesn't adhere to policy. In that case, the validity of PIN should not be checked at all, since that would otherwise create a brute-force vulnerability.
Small spell fix
sebastiannielsen
requested review from
jmanico,
kwwall,
mackowski and
szh
as code owners
spell fix 2.
andrzejsydor
approved these changes
Jan 7, 2026
szh
requested changes
Jan 7, 2026
Collaborator
szh
left a comment
szh
left a comment
There was a problem hiding this comment.
The language and formatting is a bit too casual. Can you make it fit the tone of the document better?
Author
|
The lint checker on 109 is a footnote that refers to the * item in the ordered list, so how should this be expressed so the lint checker don't complain? @szh Could you help me a bit, im native Swedish and not English, even tough im very good at english, it kinda hard to understand what you meant with "causual". |
Collaborator
I think you should use |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
You're A Rockstar
Thank you for submitting a Pull Request (PR) to the Cheat Sheet Series.
Please make sure that for your contribution:
[TEXT](URL)If your PR is related to an issue, please finish your PR text with the following line:
** Not related to issue **
AI Tool Usage Disclosure (required for all PRs)
Please select one of the following options:
the contents and I affirm the results. The LLM used is
[llm name and version]and the prompt used is
[your prompt here]. [Feel free to add more details if needed]Thank you again for your contribution 😃