It's a C#, ASP.NET MVC Project and here is the problem:

User can enter their email address in the reset password text field and click on the Reset Password button. Each time the user clicks on the Reset Password button a new email will be sent to that email address.

I am trying to limit the user reset password email to only once every x hours.

What are the possible solutions?

Here is what I have in mind so far, but I guess there are some other smarter ways:

  1. Create a cookie on the client side once the first reset password request came, and set the cookie expiry date to x hours. As long as the cookie exists, don't let user reset their password. (The problem with this is that the user can easily use a different browser or remove that cookie manually)

  2. Create a new DB table and insert the user email address and expiry date into that table. When user tries to reset his password, as long as the record exists in the DB don't let future reset password emails be sent.

  • 2
    #2 is cleanest.
    – 9000
    Jul 24, 2017 at 3:06
  • If you're doing this well (sending a link through which they can reset their password, not emailing them a new password), you'd already need to have some persisted info in the DB tracking the link you send them, when it expires, whether it's been used, etc. So you should naturally be able to extend that info, or even reuse it in its current form Jul 24, 2017 at 17:30

3 Answers 3


The second approach works well. I used something similar in a recent project. When someone requests a password reset, it generates the verification code (used for the verification link) and puts it into a table along with the email address and a timestamp. If a password reset is requested again, it checks that table first and won't send out the email if another request had been made within the past X minutes.

There's a periodic task that then goes through and clears out any password reset entries as they expire (for ex, after 24 hours).


Your assertion about cookies is correct. Cookies are in the hands of the enemy. They are not tamper-proof, so you can not use lack of a cookie as a proof that the user did not visit the site before.

Instead of creating a new database table, you could just add a field last_password_reset_mail_send_timestamp to your general user account table. When the (alleged) user wants a password reset for an account, check if last_password_reset_mail_send_timestamp is smaller than the current timestamp minus the configured timespan between resets.

The reason for saving the begin of the reset-forbidden-period instead of the end is that with that design changing the timespan setting affects the old database entries as well.


I agree cookies is a bad solution. It will be better if we track in a new column the last password change request timestamp and check if its under x hrs if its is the user should be shown another verification page saying didnt receievd email ? please retrigger here just to give a blanket of email lost scenario or give message of retry post x min .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.