如何通过电子邮件发送用户新链接来创建密码

Question

According to this other post, I need to:

PHP password recovery You don't 'recover' passwords. What you do is one of 2 things.

1. Email the user a link to create a new password, overriding the current one.
2. Email the user a randomly generated password, then ask them to change it.

I've bitten off a huge project, and I desperately request working examples, or at least your best advice on how to do this; for ex: #1 email user link to create a new password, overriding the current one. I am told the db has password salting, and uses Blowfish. I really do not know exactly what that means, and I am going over the code to try to figure out how to add a "Reset Password?" link to their current login page.

Then, if you are so inclined, could you assist with how to email the user a randomly generated pw, then as them to change it [#2 above?

The tasks are as-is and I don't know what code to provide so far; I'm hoping someone who has done this can show me what works, and I will try to implement it. I appreciate your help!

Answer 1

The usual way to generate password resets looks like this:

1. Check that the email address belongs to a registered user.
2. Generate a random unpredictable code.
3. Store this code hashed in the database, together with the user-id and an expiry date.
4. Send a link with this code to the given email address, so only the user itself will get this link.
5. When the user clicks the link, extract the code, and check if its hash is in the database.
6. If it is in the database and did not already expire, you know the user-id and you can allow the user to enter a new password (do not send a self generated password to the user).
7. Mark the code as used or delete it from the database.

I hope this could give you an idea of the necessary steps. If you want to learn more about BCrypt and salting, you can have a look at this tutorial about hashing passwords.