title: Resetting passwords: What is an elegant solution?
body: <p><strong>The Question:</strong> </p>
  
  <p>How can I verify who is resetting a password without requiring security questions, D.O.B, or any other parameters?</p>
  
  <p><strong>The Context</strong></p>
  
  <p>On many websites, when a password reset is requested, a random hash is attached to the username in a database. This hash is sent as part of a URL in an email to the user. When the user clicks on the emailed link, they are sent to a page where they can choose a new password. The problem here is, the user can type in any email address on this "Set New Password" page, and set a new password for that account. So how can I verify that a user actually owns the account to which they are setting a new password?</p>
  
  <p>I figured that the URL containing the random hash should be sent as a parameter along with the new password, because the password can then only be set when the hashes match. However that doesn't work since the $_GET['hash'] variable only exists on the set password page, which was linked from the email. As soon as the user clicks "Submit," the $_GET['hash'] variable has disappeared. </p>
  
  <p>The simple solution would be to pass the $_GET['hash'] variable AGAIN through the URL on Submit, but that creates an extra step for the developer, and might confuse them. (I am creating a library, so my code must be simple enough for a developer to understand and integrate).</p>
  
  <p>How have people tackled the problem before? Some people have suggested to make the reset link time-limited. This would help, if say the link was only valid for 30 minutes, then that means a malicious user could only change someone elses password if that person requested a reset in the last 30 minutes. However, there is still a window of vulnerability there, so it's not perfect.</p>
  
  <p>Please ask for clarification if needed.</p>
  
  <p>Thank you</p>