3 ms·
>Redirect is the cleanest solution. Exactly. Submitting tokens via GET requests (as is necessary for an emailed token) should be handled in the same way as PO
by bahjoite 10y ago
>Redirect is the cleanest solution.
Exactly. Submitting tokens via GET requests (as is necessary for an emailed token) should be handled in the same way as POST (POST-redirect-GET): the resource which validates the token should not be the one that presents the "password reset" form.