So I'm working on my first password reset mechanism. I'm going with what I understand to be a fairly common procedure:
- User clicks "Forgot Password"
- User is prompted for email address
- If the entered email address is valid, send an email with a reset link to it
- Reset link uses a token of some kind to identify the user account and keep its details secure
- When password is reset, generate a new token and save it to the user account
I feel like this should be pretty secure, but I was wondering if anyone could provide any insights that I may not be considering at this point.