Question

I am creating a forgotten password page and will be emailing a temporary password to the user so they can log in and reset their password.

What should I take into account when creating the password, what is the best method.

An idea I had is something like: $temporarypassword = sha1($_SERVER['REMOTE_ADDR'])

In an attempt to only allow them to login from the ip address where they requested the temp password. What is the best way to do this??

Code so far:

      if(strpos($_SERVER['HTTP_REFERER'],'domain.com') && ($_POST['forgotpasstoken'] == sha1($_SESSION['token'].'forgotpassword'))){
        if(isset($_POST['forgotemail']) && !empty($_POST['forgotemail'])){
            $email = mysql_escape_string(trim($_POST['forgotemail']));

            if(filter_var($email, FILTER_VALIDATE_EMAIL) === FALSE){
                echo '<div class="error">Please enter a valid email address.</div>';
            } else {
                $sql = "SELECT email FROM users WHERE email = '$email' LIMIT 1";
                            $res = mysql_query($sql) or die(mysql_error());
                                if (mysql_num_rows($res) > 0) {

                                    //If email/user exists
            $temporarypassword = sha1($_SERVER['REMOTE_ADDR'])  
                //EMAIL PASSWORD HERE           

        echo '<div class="success">A temporary recovery password has been emailed to you.</div>';
                                    //If email/user exits
                                } else {
                                    echo '<div class="error">This email is not registered.</div>';
                        }
            }

        } else {
        echo '<div class="error">Please enter an email address.</div>'; 
        }

}

Answer 1

Use just a random string: it’s more than likely that user tries to log in from e.g. iPhone, fails, requests a new password, and only opens the link when he’s at his home PC. IPs are different, device is different, everything’s different.