It's pretty common for sites to have a password reset system on websites, which allow you to enter your email address, and have the site email you a link you can use to reset your password.
I had a specification that demanded this kind of system, however it needed to be stateless - in that I could not store any extra information. Also, the hash could only be used once, and it was required that it needed to time out after a configurable time period. Also, the URL must be short enough such that it can be easily copied and pasted into the address bar from an email, and doesn't wrap in the email.
Continue reading "Stateless password reset system"