Home/ Questions/Q 6923079
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T10:29:23+00:00

Is there anything wrong with this procedure? Enter in username and email in a

  • 0

Is there anything wrong with this procedure?

  1. Enter in username and email in a reset form.
  2. Flask creates a really long random string and stores it into the session under “reset_code”. Session will also have a key for “reset_pw_username”
  3. Flask sends an email with a link to the path /password_reset/reset_pw_username/reset_code
  4. That link displays a form where the customer can reset the password if the session reset code matches the session reset_code item. Otherwise it bombs out.
  5. The session will expire the reset code after an hour.
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You must ensure that username and email entered match one of the accounts (or use emails as username in the first place).

    From a usability perspective, this won’t work if the browser that displays the link contained in the email is not the same as the one initially used.

    Apart from that, you should pay special attention to the randomness (not so much the length) of the reset_code. It should be cryptographically random (i.e. os.urandom) so that an attacker cannot simply guess it. random.random and derived methods are not suitable.

    • 0