hard20 pts · first answer countsauthenticationweb-security

Designing password reset links

Which password reset design is the most secure?

A.A signed JWT containing the user ID, valid for 7 days and reusableB.A random high-entropy token stored only as a hash, short expiry, single use, the same response whether or not the email exists, and other sessions ended after resetC.Email the user a new random passwordD.A token made of base64(email + timestamp) so no database lookup is needed

Discussion 0

Join free to post in the discussion.

Designing password reset links

Discussion 0

Related questions