Is there a way to generate a single use token for password recovery, without using a database?

This is because, I have an application that doesn't have a database, and doesn't store or has access to the login database. I use a Web Service to login the users, and store everything I need on a session. So there is no need for a database.

I can create a token, that will be available for a certain amount of time, but that doesn't mean it will not be used more than once.


There is a database, which has all the data of users. The application doesn't access it, but through a Web Service. To this Web Service the application sends the credentials, and the Web Service replies if it's valid or not. When you successfully log, it will show you information regarding your user, which means, the application will use a series of Web Services to gather this information. All these Web Services are only available to the local network.

The optimal solution would be to modify the Login Web Service. But since it's so old, they don't want to modify it, but completely change it, eventually.

Right now, we need to add a way for users to recover their password. And we need a quick solution, not redo the Login Web Service right now, nor modify it.

Possible solution:

I can generate a token, no problem with that, and then send it to the user. This token will be the encrypted date before the token expires, along with some data to make it unique to the user. This token will be read and if it's expired, it will be ignored.

Ideally, as soon this token is used to successfully change the user's password, it would update the database to let it know the token was used. But since this doesn't exist, nor we can have it right now, there is no way to know when the token was used.

We are thinking of maybe storing the temporary tokens on cache. I could ask opinions on that approach, but that would probably be off topic.

Thanks for all your enquiries and ideas.

closed as unclear what you're asking by Jörg W Mittag, BobDalgleish, Robert Harvey May 16 at 17:46

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Are you able to retrieve any information from your login provider such as timestamp for last password change? – guest May 15 at 20:30
  • No, and if it exist I don’t access to it. Thanks though that is pretty good idea. – Pablo Carrasco Hernández May 15 at 20:36
  • 2
    Is your problem uniqueness? Create a GUID. – Robert Harvey May 15 at 21:04
  • @RobertHarvey The problem, as I understand it is preventing reuse. – JimmyJames May 15 at 21:05
  • By someone else? They would have to guess the GUID. Expire it once it is used. – Robert Harvey May 15 at 21:19

This may be a bad practise but you can store a value on app cache to make the token verification (iisue date, duration,user id). This could be a way (depending on the amount of users) and you have to delete expired tokens once a while.

Not the answer you're looking for? Browse other questions tagged or ask your own question.