2 ms·
What is a good way to generate a password reset token? Is this even close to standard? generates_token_for :password_reset, expires_in: 15.minutes do # L
by lcnPylGDnU4H9OF 3y ago
What is a good way to generate a password reset token? Is this even close to standard?
generates_token_for :password_reset, expires_in: 15.minutes do
# Last 10 characters of password salt, which changes when password is updated:
password_salt&.last(10)
end
Using a value that can be known externally -- because it is saved in plain text in the database, which I assume has been, will be, and is being breached -- seems like a security hole.
- Zanfa 3y agoIf an attacker has plain text access to the database, they likely don’t care about resetting a password to gain access to a user’s account.
- lcnPylGDnU4H9OF 3y agoIt's more an assumption I make to help guide how I build applications. Put another way, I wouldn't bother hashing the user password if I expected that I would always perfectly prevent all unauthorized reads from the database. If someone knows that my application will just use the last 10 characters of the salt for a password reset token and they initiate the password reset for a user, they can potentially use the data from last month's breach to reset a user's password.
- samrolken 3y agoThe token is further hashed with the application secret key the same way any token would be.