Insecure Password Reset Flow

Also Known As

TL;DR

Explanation

Common flaws include: predictable reset tokens (timestamp-based or sequential), tokens that don't expire, tokens that remain valid after use, user enumeration via reset responses, and Host header injection into reset emails. A secure reset flow generates a cryptographically random token with random_bytes(32), stores a hash of it in the database, expires it after 15–60 minutes, invalidates it immediately on use, and uses a constant-time comparison (hash_equals) when verifying.

Common Misconception

Why It Matters

Common Mistakes

• Using rand() or uniqid() to generate reset tokens — both are predictable.
• Not expiring reset tokens after a short window (e.g. 15-30 minutes).
• Not invalidating a reset token after first use — allows repeated use of a stolen token.
• Sending the new password in the email instead of a single-use reset link.

Code Examples

// Predictable token, no expiry, no single-use enforcement
\$token = md5(\$user->email . time());
\$user  = DB::where('reset_token', \$_GET['token'])->first();
if (\$user) allowPasswordReset(\$user);

// 1. Cryptographically secure token
\$token  = bin2hex(random_bytes(32));
\$hash   = hash('sha256', \$token); // store hash, send raw
\$expiry = now()->addHour();

DB::table('password_resets')->insert([
    'user_id'    => \$user->id,
    'token_hash' => \$hash,
    'expires_at' => \$expiry,
    'used'       => false,
]);

// 2. Verify — constant-time, expiry check, single-use
\$record = DB::table('password_resets')
    ->where('token_hash', hash('sha256', \$inputToken))
    ->where('expires_at', '>', now())
    ->where('used', false)
    ->first();

if (!\$record) abort(400);
DB::table('password_resets')->where('id', \$record->id)->update(['used' => true]);

References

• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html
• ↗ https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/09-Testing_for_Weak_Password_Change_or_Reset_Functionalities

Tags

Related Terms