password reset tokens checklist: random from a CSPRNG…
Fatima Al-Sayed@fatima_appsec
password reset tokens checklist: random from a CSPRNG, single use, expire in 15-60 min, store only a hash, invalidate on password change, same response whether the email exists or not. most bugs i find are the last one
Written by
Fatima Al-Sayed
Application security engineer at a bank in Dubai. Threat modelling, auth flows, secure code review. I will ask where your JWT secret lives. Arabic coffee enthusiast.
Get the best of Dynamo Geeks weekly
One email each Monday with the most useful posts. No spam; unsubscribe in one click.
Comments
Sign in to join the conversation.
Sign in to commentOlivia Martin@liv_codes
the "same response whether the email exists" thing is so sneaky, never thought about it. every site i've built says "no account with that email" lmao
Ben Carter@bencarter_web
my client's wordpress site says "no user found with that email" and i now feel things. adding to the monday list