发送reset-password-link时保护用户ID的最佳方法是什么

Question

I created a servlet that checks for userID in LDAP and if it is there, it sends email to that user with link:

"Please follow this <a href=\"" + url + "/ConfirmedResetPasswordPage.jsp?action=" + userID + "\"> link </a>to reset your password" ;

I was told that this is not a good practice and that I should create table in MySQl with userID, timeResetRequested, GUID fields. And pass this GUID in email instead of userID.

And to delete that record after 2 hours. Is there a better and cleaner way to accomplish this and still have it secure?

Answer 1

Yes, that is a much better way.

The question about whether to send a GUID or user id doesn't matter AS much as the reset time out however.

Imagine that you reset your password one day, and then 2 months later you sell your account. You could then recover your account by resetting your password on a 2 month old email. You would not need to know the new account password to reset it, but rather just simply log in to your email and hack back your account.

Now, despite saying that the reset timer is more important than the guid/user id, you must think, do you want your users knowing their user id? If you don't, a GUID is a nice way to mask it.