You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by mo...@physics.gmu.edu on 2003/11/10 18:54:27 UTC
Inputs needed for Reset password
Hi All,
I am doing a reset password page using struts. The user clicks on a
forgotpassword link which takes him to a page where he enters his email
address. We send him a http://blah.org/resetpwd.jsp?xdksdfksdfsdf URL with
the key attached to the URL. The key expires in 24 hours. The user checks
on this link in his email. We need to verify if the key is still valid and
then allow him to change the password. I am not sure how to generate these
random keys. Also let me know if there is an efficient way to check the
time stamps for these keys.
Thank you very much
--Mohan
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: Inputs needed for Reset password
Posted by Andrew Beames <st...@roocomputing.co.uk>.
On Monday 10 Nov 2003 5:54 pm, mohan@physics.gmu.edu wrote:
> Hi All,
> I am doing a reset password page using struts. The user clicks on a
> forgotpassword link which takes him to a page where he enters his email
> address. We send him a http://blah.org/resetpwd.jsp?xdksdfksdfsdf URL with
> the key attached to the URL. The key expires in 24 hours. The user checks
> on this link in his email. We need to verify if the key is still valid and
> then allow him to change the password. I am not sure how to generate these
> random keys. Also let me know if there is an efficient way to check the
> time stamps for these keys.
>
> Thank you very much
> --Mohan
Is JSESSIONID random enough for you? Store the derived value with the user's
account details along with a "when-requested" timestamp column and the check
can even be done in SQL.
SELECT password FROM Account
WHERE key = <jsessionid>
AND when-requested > TODAY - 1 DAY
(DB2 speak. Adjust to suit your own DB)
However, if you want to check the key's expiry from its value, you'll have to
generate it from Calendar (for example) and extract the time part during
verification. Care needed: could be easy to spoof.
Andrew
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org