问题
As far as I can think, there are two reasonable ways to reset a user's forgotten password.
Have the user enter their email address and a new plaintext password is sent to their email address.
A link is sent to their email address which has a UID number in the URL. Clicking on this takes the user to a form on the website where they can choose there own new password.
Which method is preferable and why?
If method 1 is used, perhaps a third party could read the email and obtain the new password. If method 2 is used, what is to stop someone methodically going through UID codes to try and access the form to change a user's password?
回答1:
The best pattern would be :
User requests password reset. Best is to do it through username, and don't indicate if the username exists or not (to avoid possible users listing through a script)
You generate a record in a new database table with userid, datetime of request (= current datetime), and a GUID you just generated
You send a mail to the user, pointing to password reset page with the GUID (not the userid) as parameter
On this page, you should check that the GUID is existing, and eventually you could put some expiration date (=the user has 1 day to reset, for example)
Don't forget to mark the record as "used" (with an extra field in the table) when the user reset his password, so that you can stop an eventual second try...
It could possibly even more secure, but that is already quite good I think....
回答2:
OWASP has a good checklist of https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet
Here is a quick summary of steps:
- Gather Identity Data or Security Questions
- Verify Security Questions
- Send a Token Over a Side-Channel
- Allow user to change password
回答3:
Verify if the sender is the real user by asking verification questions.
Do not send password on the personal email that is not on the planate employees list.
Do not add the word "password" to the title or body of the email.
Make sure to send separately the username and password.
For Office 365 user, direct them to the forgot my password area or send this link https://passwordreset.microsoftonline.com
Don't get intimidated by the user, escalate to IT manager if the need arises.
来源：https://stackoverflow.com/questions/16018180/best-practice-for-resetting-forgotten-user-passwords