Hello,
What are the best options for a user to recover a password?
I see two options:
1) Generate a new random password and send it to the user.
2) Send a url to the user for a form to change the password.
On the url it contains the ID of the user and a KEY which was created from various fields in the USERS table and hashed.
Then I confirm the KEY and the ID. If it matches I allow the user to change the password.
One of my problems is that this URL shoudl expire after some time or not?
How can I do this?
Thanks,
Miguel
...
Go to the complete details ...