PHP – How to implement password reset and token expiry

  1. When your user requests a password reset, generate a token and calculate its expiry date
  2. Store the token and its expiry date in separate columns in your users table for that user
  3. Send an email to the user containing the reset link, with the token appended to its URL
  4. When your user follows the link, grab the token from your URL (perhaps with $_GET['token'])
  5. Verify the token against your users table
  6. Check that it’s not past its expiry date yet
    • If it has expired, invalidate it, perhaps by clearing the fields, and allow the user to resend
  7. If the token is valid and usable, present your password reset form to the user
  8. Validate and update the password and clear the token and expiry fields

Leave a Comment