Question

I am coding a link sent by email for users to reset their password. I want this link keep two parameters “send date” and “user id”. so it may looks like

www.resetpassword.aspx?senddate="..."&userid="..."

I think these parameters should be encrypted and what I am wondering is that is it necessary to encrypt by some complicated two way algorithm or I can just convert the ASCII string to hex code.

Should I let users see there are send date and user id in the link? is there any general standard to do this?

Answer 1

I wouldn’t encrypt it. When a user initiates a password reset, put a random token into their user details (if you have a database, that is). Validate against that token. Once the password has successfully been reset, eliminate that token from the db.