如何从令牌获取password_reset数据？

Question

I am working on password reset functionality .

As of now, the email field is mandatory to fill. But I want to remove that email field(which I will get by using the token from the database and keep it in a hidden field in reset form) from the reset form.

As I can see password_resets table has those passwords reset request records along with email , token and created_at fields.

I am trying to decode the token which I will get from URL, to compare with a token which is saved in the database.

I tried,

//Hash::make
//$this->hasher->make
//Crypt::decrypt
//sha1
//md5

On the token I will get from url.

But still I am unable to get exact matching token to compare with token which exists in database table password_resets .

I had went through this link . Which says Password reset tokens are now stored as bcrypt of sha256 . But I don't understand how do I decode that token.

Do anyone faces this problem? Any idea? Any suggestions?

Answer 1

You can't decrypt a hash since hashes aren't encryption. Hashes are used to make a unique 'fingerprint' of a piece of data. Hashes don't contain the full data and therefore there is no way you're able to reverse it.

But the password_resets table should contain the token if it has been issued. A simple query like

SELECT * FROM password_resets WHERE token = ?

should return the email adress.

Make sure there's data in that table to begin with.