Password reset and email verification issue #9 closed: completed andymccall opened this 1 month ago · 0 comments

Nobody can recover an account whose password is lost, and email addresses are never checked. Add:

• Password reset: a single-use, short-lived link. Sent by email when SMTP is configured; otherwise an administrator issues the link from the admin page and hands it over.
• Email verification: a link sent when an email is set or changed; the account shows whether its email is verified, and notification email goes only to verified addresses.

Tokens are random, stored only as hashes, expire, and are consumed on use; a reset ends every other session. The request page never reveals whether an account exists.