node js - 如何安全地将令牌从 http get 请求传递到 html 页面？

Question

I am working on implementing my own custom password reset that sends an email where the user is taking to a page to reset their password.

So far I have generated a unique token that gets put in an http get request link and emailed to the user.

When the user clicks the link (example mywebsite.com/verifypasswordreset?id=96rZyAWLTu )

I have an express route that gets the token:

//Verify Password Reset
app.get('/verifypasswordreset', function(req, res) {
    Parse.Cloud.run('verifyPasswordReset', { token: req.param("id") }, {
      success: function(user) {   
          res.sendFile(path.join(__dirname + '/website/resetpassword.html'));
      },
      error: function(error) {
          res.sendFile(path.join(__dirname + '/website/404.html'));
      }
    }); 
});

I then run a Parse cloud code function that validates if the token exists and if so it responds by sending the html that contains a form for resetting the password. ( resetpassword.html )

At this point resetpassword.html page's url still has the token embedded in it ( mywebsite.com/verifypasswordreset?id=96rZyAWLTu ) however, as soon as the user submits the form, it does a http post and posts the new password, leaving the token behind in the link and thus I don't know which token is associated with the password reset?

//Reset Password
app.post('/resetpassword', function(req, res) {
    res.send('You sent the password "' + req.body.password + '".');
});

When the user submits the form to change their password, how can somehow get the token from the current url ( mywebsite.com/verifypasswordreset?id=96rZyAWLTu ) and include it in the http post request so my node js app can read it and knows which token is associated with the password reset?

Or alternatively, is their a better & safer way to keep track of the token?

*note ignore that I am using http I am going to buy an SSL certificate and use https before launch.

Answer 1

I don't see the point of validating the token when you are simply sending a resetpassword.html page. However, the token MUST be validated when actually updating the password for a user. So, here's a slightly modified workflow:

User clicks the link (example mywebsite.com/passwordreset?id=96rZyAWLTu)

app.get('/passwordreset', function(req, res) {
      res.sendFile(path.join(__dirname + '/website/resetpassword.html'));
});

Your resetpassword page's URL still has the token embedded. Now, user submits the form, it does a http post and posts the new password.

app.post('/passwordreset', function(req, res) {
Parse.Cloud.run('verifyPasswordReset', { token: req.param("id") }, {
  success: function(user) {   
           //update user's password here
           res.send('You sent the password "' + req.body.password + '".');
  },
  error: function(error) {
      res.sendFile(path.join(__dirname + '/website/error.html'));
  }
});