Home/ Questions/Q 451315
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T21:57:23+00:00

I am using ASP.NET MVC with ASP.NET membership. Following best practices for ‘I forgot

  • 0

I am using ASP.NET MVC with ASP.NET membership.

Following best practices for ‘I forgot my password logic’ I want to do the following :

  • send the user an email with a link to a unique, hidden URL that allows him to change his password
  • asking for a password reset does NOT reset the password. you need the unique link.

I’m looking for suggestions on the best way to generate this URL, make it valid only temporarily and then validate it. I think the ASP.NET membership standard way is to have a ‘security question’ which is really a lousy way of doing it.

What would be the best way to generate and validate such a link. SHould I just generate a GUID and put it in the user’s profile? I dont think there is any other pre-built right?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Your solution is fine… Generating a GUID is OK for temporary password resets. Just be sure you aren’t generating it until the user asks for it, then add it to their profile with a timestamp… and give it a very short window of opportunity, like an hour. Reset/clear it when the user accesses the URL.

    • 0