C＃中的一次性密码是否在一定时间后到期？

Question

I'm working on a log in page for a website now in C#.net and have encountered an issue, and was hoping you guys could help me out.

This is the case : The user comes over to the log in screen, then from there they key in their e-mail, we'll reference with the database to check for validity, and if it's valid, a random 8 digit key will be generated and sent to the email. The user should now check his/her email to get the "One-time-password" and then key into one text box to proceed.

The generation and email sending has been done, but I'm not sure how to continue doing this

There's some discussion among my team members, one of them proposed to use a session timeout, and then when the button is clicked, the email will be sent , a session variable will be created and have the one time password stored in it, then we will reference the textbox's text which the user has entered with the session variable and if it's correct, they'll be logged in.

Another way I was thinking of is to use Javascript timers, then reference with an invisible label on the web page. But I'm not sure if Javascript can allow that to happen..

What are your best approaches to this situation?

Thanks!

Answer 1

It is time sensitive, just store the code in the database with an expiration datetime. Then when the user comes back with their token you can see if it is has not yet expired, if it has then ask them to start the process over.