Question

I am looking to build a “reset password” function in my CakePHP app, and reading around the net I have decided to: Have the user type in their email address, send them an email with a link to http://www.mysite.com/users/reset_password/generated_uuid_that_expires_in_24_hours. This will present a form that allows them to change their password. Obviously the hiccup is that I don’t know how to log the user in with a temporary password. Am I approaching this correctly? I am thinking that the url I send them would be a hashed version of their email plus a uuid to use as a temp password, and that I would perform a user id lookup based on the email that comes in the url….but still, I wouldn’t know how to manually log them in so they can change their password.

Answer 1

I use the session approach.
after using the token from the email the user gets a

Tmp.User.id (as opposed to Auth.User.id)

in the session which will allow him to change the password.
afterwards it will be removed from the session again.