3 ms·
One thing I like about keeping reset tokens in the database is that you basically get a free audit log (if implemented properly). Some other disadvantages were
by pfg 11y ago
One thing I like about keeping reset tokens in the database is that you basically get a free audit log (if implemented properly).
Some other disadvantages were pointed out in the previous discussion[1].
[1]: https://news.ycombinator.com/item?id=9053830 https://news.ycombinator.com/item?id=9053830
- tripzilch 11y agoThe top "disadvantage" discussion in that thread is about somebody messing up their links because they rolled their own base64 encoding with period characters in it ... or something like that. I'm not even sure what they were thinking, but there's nothing about keeping reset tokens in the database that would prevent their problem.