how to implement the create new password functionality directly from user's email

Question

I am trying to implement the scenario in which a new user has been created in my application by Admin.

1st step will be user has allotted by a temporary password and receives the email with an activation link

User will just by clicking on that link taken to the create new password page , he creates his new password and thats it.

Now my query is how will the application knows that which user is this ,just by clicking that activation link in his email

Answer 1

Activation links carry a long token, such as activate.jsp?tok=98357627272357852786276258763427934579342579342793426734279 . This token can be randomly selected, and stored in a database. When the page is loaded, the token is looked up, and the correct user gets authenticated. The token may then be deleted from the database.