How to give pwd reset link an expiration time?

Blueie · Jan 16, 2016

Hello

I am groping in the dark a little here.

I am hoping to put together some code whereby a user receives a link in his inbox to reset his password.

Following a couple of (outdated) tutorials, I have this in my code:

Code:

 cmd = New OleDbCommand("UPDATE university SET uniqueCode=@uniqueCode where strEmail = @strEmail", conn)

cmd.Parameters.AddWithValue("@uniqueCode", uniqueCode)
cmd.Parameters.AddWithValue("@strEmail", strEmail.Text.Trim())

End If

Dim strBody As New StringBuilder()

strBody.Append("<a href=[URL unfurl="true"]http://localhost:2464/SampleApplication/ResetPasswordVB.aspx?emailId="[/URL] + strEmail.Text & "&uniqueCode=" & uniqueCode & ">Click here to reset your password</a>")

Should this strBody be a column in my Access database (not clear from the tutorial), and would the uniqueCode be displayed in a column like
this?

If so, how would I give the link a lifespan of X hours?

Many thanks.

jbenson001 · Jan 18, 2016

I don't know what code you looked at, but I would assume that uniqueCode is a code that is placed in your query string.
Then when you go to the page, you grab that value and look it up in your table.
To add the expiration time, you can add a column to your table that has a datetime column. This value would be set when you insert the row into the table.
Once you get the row you are looking for, compare the current time with the datetime in the expiration column.

Also, on another note, you should never save your passwords as plain text. This is a major security issue. If someone were to hack your DB, they would have everyone's user name and password.

Blueie · Jan 18, 2016

Hello jbenson001

Thanks for replying.

Once the site is up and running the passwords will be hashed/salted.

Do you mean that adjacent to the uniqueCode column, I would have another column called, let's say, timeLimit, and that the whole column is a DateTime columm whose properties, I think, are set in Design view?

Thanks again.

jbenson001 · Jan 18, 2016

No, what I mean is, when someone clicks the "Forgot Password" link on your page, you would update a column called "timeLimit" with the current date/time with the date/time + say 3 hours.
Then you can use that column to compare to the current date/time to see if it has expired.

Blueie · Jan 18, 2016

So, clicking on the Forgotten Password link would trigger an insertion (not really an update because it may be the first time) of X amount of hours and that would be recorded in the timeLimit column?

OK. Thanks. I am not sure I would be able to code that!

I would need to display another message to the user that the X amount of hours had expired.

Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

How to give pwd reset link an expiration time?

Blueie

Technical User

jbenson001

Programmer

Blueie

Technical User

jbenson001

Programmer

Blueie

Technical User

Similar threads

Part and Inventory Search

Sponsor