Question

I am trying to create a forgot password feature which will expire the link created after x hours. So I am storing time() data in database value when a user requests a password reset. So how can I expire it?

Answer 1

three options:

• compare the time you saved on the db with the one you get when the user click the link
• Use a cron job and make it run periodically
• Just don’t save in the db and make the link to care about everything. You could use a signature + a salt to avoid users to modify this link

like:

$now = time();

$sk = sh1($user_id . $now . "yoursupersalthere")

$link = "http://www.example.com/forgot.php?id={$user_id}&ts={$now}&sk={$sk}"

that will be the link you sent to the user. Then to make the check

$ts = $_GET['ts'];
$user = $_GET['id'];
$sk = $_GET['sk'];

if (!$sk == sh1($user_id . $now . "yoursupersalthere")) {
    die("bad signature");
}
elseif (time() - $ts > 3600 /* or put your expiration limit */) {
    die('link expired');
}

// do your job