Is there a way to generate a single use token for password recovery, without using a database?
This is because, I have an application that doesn't have a database, and doesn't store or has access to the login database. I use a Web Service to login the users, and store everything I need on a session. So there is no need for a database.
I can create a token, that will be available for a certain amount of time, but that doesn't mean it will not be used more than once.
There is a database, which has all the data of users. The application doesn't access it, but through a Web Service. To this Web Service the application sends the credentials, and the Web Service replies if it's valid or not. When you successfully log, it will show you information regarding your user, which means, the application will use a series of Web Services to gather this information. All these Web Services are only available to the local network.
The optimal solution would be to modify the Login Web Service. But since it's so old, they don't want to modify it, but completely change it, eventually.
Right now, we need to add a way for users to recover their password. And we need a quick solution, not redo the Login Web Service right now, nor modify it.
I can generate a token, no problem with that, and then send it to the user. This token will be the encrypted date before the token expires, along with some data to make it unique to the user. This token will be read and if it's expired, it will be ignored.
Ideally, as soon this token is used to successfully change the user's password, it would update the database to let it know the token was used. But since this doesn't exist, nor we can have it right now, there is no way to know when the token was used.
We are thinking of maybe storing the temporary tokens on cache. I could ask opinions on that approach, but that would probably be off topic.
Thanks for all your enquiries and ideas.