3 ms·
Why? Just make the user go through the reset-password flow.
by ThePowerOfFuet 5y ago
Why? Just make the user go through the reset-password flow.
- premek 5y agoin that case you don't send them a randomly generated string called a password but a randomly generated string called a token, right?
- ThePowerOfFuet 5y agoCorrect, but it's generated only when they initiate the reset-password flow, and should be time-limited and only usable once. It's not stored in the database for long periods.