It's a C#, ASP.NET MVC Project and here is the problem:
User can enter their email address in the reset password text field and click on the Reset Password button. Each time the user clicks on the Reset Password button a new email will be sent to that email address.
I am trying to limit the user reset password email to only once every x hours.
What are the possible solutions?
Here is what I have in mind so far, but I guess there are some other smarter ways:
Create a cookie on the client side once the first reset password request came, and set the cookie expiry date to x hours. As long as the cookie exists, don't let user reset their password. (The problem with this is that the user can easily use a different browser or remove that cookie manually)
Create a new DB table and insert the user email address and expiry date into that table. When user tries to reset his password, as long as the record exists in the DB don't let future reset password emails be sent.