How to handle forgot password to reset password using a one-time link.

[@shakilahmed6870]

One suggestion for all. Instead of generating jwt secret using a secret key+user old password, use crypto to generate a new secret key each time user wants to reset the password and store the secret key in your database. When user successfully resets the password, just delete the secret key from database so that it cant be used again.

[@shrutisharma8750]

Your explanation is soo good

[@mafiacodes]

Glad it was helpful!

[@neishaosu3402]

I really loved your explanation. It was straight to the point, without any unnecessary bullshit. Plain, simple, and easy to follow for resetting the password. Good job!

[@NickTheDevGuy]

Ahh thank you so much! I've been looking for this for almost a week. The other videos on YT all use randomly generated crypto tokens, but I wanted to use JWT instead. This was a life saver, and very well explained. Thanks again man!

[@RajnishKumar-wi8zl]

best video in the youtube for the reset password technique

[@varadgauthankar]

really loved the tutorial, it's perfect how you only focus on the topic and not other things. Thanks a lot.

[@ali-celebi]

I like the way we can leverage JWT to create a token which helps us to create one-time link. Useful tutorial!

[@weiyangxumo5671]

Thanks for the video! It's easy to learn. I like the way you skip the unimportant part and only focus on password reset!

[@loirenhuh]

Bro you are my superman, for my deadlines

[@mafiacodes]

Subscribe like share

[@jonathanlozanoh4231]

@@mafiacodes yes

[@vemuyaswanth803]

This is so frickin' clear. Thank you pal!!!

[@ankitbansal6450]

Amazing video bro , simple and clear explanation

[@mafiacodes]

Glad it helped

[@osherezra8460]

Right on the point and so clear thank you so glad I'v found this channel man keep it up

[@shaileshk_gy]

Please provide a link to the code in the description. That would be awesome.

[@richardstowey]

Thanks for providing such a clear tutorial on how to do this. Much appreciated!

[@johardas8954]

your videos are of very high quality.

[@mafiacodes]

I appreciate that! Thank you!

[@nonlinearacademy]

Hi, thank for this awesome tutorial. Just I'm curious if there is any repository with the code from your example?

[@daviddaedae]

Love these node tutorials

[@sofienethabet7727]

Please provide a link to the code in the description. That would be awesome. Thanks :D

[@jakubgadzala7474]

Great video! Subscribed to channel. Thank you.

[@jakubgadzala7474]

So, I have watched it earlier today. By now I have watched it second time and implemented into my project without any hussle whatsover! The quality of your tutorial is better than many I have watched on udemy. They usually talk to much or not clear enough. Your explanation was perfect, step by step, easy to replicate in any project. Thank you a milion again sir!

[@robhawkins2446]

This was excellent, thank you!

[@juanssal]

Clear and simple. Thanks my friend

[@ant9177]

Can you tell me what font is used in Vs code ?

[@jumaelahmed9995]

Which font you are using can you please tell me?

[@JSXPLANET]

thanks you for your clear explanation , i have a doubt regarding where the token is storage in the project , is into cache?

[@gauravbawa5609]

Thanks you so much for this video.. thanks to you i have able to complete this authentication part smoothly. I find many challenges when using the same code with database but little by little debugging finally i happen to get to the same result.. Your content is really worked with real case scenario. I really appreciate the time and effort you took to explain the process concisely.

[@emtezet29]

It is not one-time link if the user sets exactly the same password. It should've been generated private key, stored on distributed fs or memory until user changed their password. Once done you remove the key. Obviously you need to have a dedicated authorization mechanism just for this endpoint.

[@mouadbfs349]

Thanks this tutorial very helpfull

[@cliffXsoul]

Thank you so much, it really helped me!

[@jdera1872]

Thanks this helps me a lot..

[@mafiacodes]

Subscribe like share

[@waytofuture]

thank you sir easy explanation af

[@namangogia9252]

Thank you, very clear explanation

[@shashwatdhingra3580]

Thanks brother

[@colindante5164]

Thankyou much ))

[@shivlingjadhav9936]

Superb 🔥🔥

[@juhandvan]

Thank you so much

[@amankhanna354]

Very informative. Thanks⚡️

[@frutoramirezjuanjose5930]

Which vscode theme color do you use?

[@rohitjakhmola7446]

help alot....

[@jesseemana9598]

amazing channel

[@official-ali]

Great tutorial ❤️

[@thongtranlequoc688]

If the user re-enters the old password, then the token will still be valid until it expires, right?

[@jandeswart1378]

Thank you. This videao is very helpful.

[@Ahmedahmed-qg5ep]

Thanks, Bro! It helps a lot 👍☺

[@abharani9265]

Thanks for tutorials! really helpful.

[@rvb6516]

Does this work on iOS or do we have to use universal links ?

[@Rise_and_Shine1]

Good Work Bro Keep It Up Bro Can u plz provide the source code

[@mafiacodes]

I'll check if I have saved it...

[@robertphillips124714]

Great explanation, thank you very much!! Is it best practice to use the current password for the jwt secret in this way? I get that the secret is never sent to the client, but it still feels like it might be a an unnecessary risk. I'd be interested to know your thoughts.

[@mafiacodes]

No problem at all, moreover it’s more secure since we are creating a secret using a common secret and hashed password , so no worries with that

[@codingprojects4002]

Its safe to use it.. because your current password is hashed and u r using that hash plus jwt secret so no one can decode it.. even if u get hashed password text u can't get password from it.. it is secure

[@bent9808]

How do I get the user from the database from the reset password link? We didn't need a request.body

[@welvissouza7617]

Fantastic video, congratulations. Could you tell me what vscode theme you were using?

[@mafiacodes]

Snazzy operator

[@ajibolaanthony7867]

please how can i set it to get the email and password in my database

[@HSBTechYT]

For some reason jwt verify is returning false , basicaly it's not working

[@riteshthakur9250]

great video as always please also make videos on MERN full stack videos

[@mitubarua9248]

does have any git repo??

[@ruqiaimran2299]

Can we send email of the user in the url apart from id of the user Btw great content :-)

[@arnobchowdhury9641]

I have one question. Can a similar approach be taken for user's email validation when a user signs up? Great video. Thanks a lot.

[@mafiacodes]

Yes, absolutely

[@arnobchowdhury9641]

@@mafiacodes Thanks a lot for the reply.

[@danielsouza1824]

I did the signup process with jwt. With an email validation to activate account.

[@MahadyHasan]

you can check the signs-up email address on the user table on the database. If the email already exists, an error message can show." this email already registered", otherwise signs up will continue.

[@marzukzarir]

awesomeeeeee......

[@dontargetme2416]

you're my pal

[@wtrudg1]

tks so much

[@riteshthakur9250]

sir what if i am using env variable for JWT secret key and not not using password in the secret like you did only using the env variable for storing secret will it give invalid signature

[@mafiacodes]

U can only use env variable but in that case the link will be valid for lifetime of the token even if it has been used once to reset a password

[@riteshthakur9250]

@@mafiacodes so i will have to use the password with jwt secret for not use it more than one time once it is used

[@mafiacodes]

Yes

[@danielsouza1824]

That was awesome, I was looking for this kind of answer, how to generate unique token regarding the reset password, to not be valid after the process.

[@MohamedAli-vf3vy]

where can i find the source code

[@ExplorerSpace]

where is your git

[@snehabaser3155]

I have one doubt. Like during sign up i store token in database.. so is again need to generate token for reset password or i fetch from database??

[@snehabaser3155]

Please reply as early as possible. It would be great help!

[@mafiacodes]

u have to watch the full video to understand how it works, it has nothing related to signups...

[@danielsouza1824]

The token is never stored, only generated and saved in the client side (maybe in your mailbox)

[@samueloluwasegun746]

Pls can you share your vs code profile i like your extensions

[@gmix218]

Sir hello one time paasword means if you failed to use the first otp that google send...google will not send another otp again???..is that mean of otp....or they send again?? but in some other time or day??.because i reiceve my otp but accidentally i cancel my request for reset password link .then i fill up again in google recovery form and option to submit not show again..is it because i failed to use my first code???how can i get again... hope you answer me..thank you sir

[@digenmore5949]

Sir I tried with database but not working please help me with this problem.

[@kuldeepruletiya3146]

nice video,please make video on otp based login system

[@mafiacodes]

Yeah coming up

[@technoinfoworldwide2329]

@@mafiacodes when it will come sir?waiting for it

[@technoinfoworldwide2329]

Suppose my boss is giving me existing code written by others, now they provide me their api..now how to test and properly integrate in frontend (.ejs) ..can you make a video on this topic

[@Stefan-xm9qb]

What if the user resets his password and then later changes it back to the old one? Does the old link then become valid again? Your solution is trash.

[@iganic7574]

He don't show hashing part , Use bcrypt to hash password before saving it he will add some salt to it , so even if two password is same there hash will be completely different

[@josephjoey3904]

Link to source? Will help in debugging errors. Thank you

[@mafiacodes]

I will

[@josephjoey3904]

@@mafiacodes Thanks bro

[@mohamedyoussef8835]

Awesome

[@khushboogoyal27]

@yoursTRULY it says "Cannot GET /reset-password/qwerty12".

[@khushboogoyal27]

```const express = require("express"); const jwt = require("jsonwebtoken"); const app = express(); app.use(express.json()); app.use(express.urlencoded({extended: false})) app.set("view engine", "ejs") let user = { id: "qwerty12#45", email: "[e-mail]", password: "qwer123@#$fghj" } //To create a token we need secret. const JWT_SECRET = "some super secret..." app.get("/", (req, res) => { res.send("Hello World!") }) app.get("/forgot-password", (req, res, next) => { res.render("forgot-password"); }) app.post("/forgot-password", (req, res, next) => { const {email} = req.body; //res.send(email); //make sure user exist in DB. if(email !== user.email){ res.send("User not registered") return; } //user exist and now create one time link that is valid for 15 mins. //we need to create one more secret because we dont want that user can use the same link even after 15mins completed. const secret = JWT_SECRET + user.password; //this payload will be stored inside our JWT token. const payload = { email: user.email, id: user.id } const token = jwt.sign(payload, secret, {expiresIn: "15m"}); //generating link through this token. const link = `localhost:3000/reset-password/${user.id}/${token}`; console.log(link); //we can use transactional emails here. res.send("Password reset link has been sent to your email."); }); app.get("/reset-password/:id/:token", (req, res, next) => { const {id, token} = req.params //check if this id exist in DB. if(id !== user.id){ res.send("Invalid ID...") return } //we have a valid id and we have a valid user with this id. const secret = JWT_SECRET + user.password; try{ const payload = jwt.verify(token, secret) res.render("reset-password", {email: user.email}) } catch(error){ console.log(error.message); res.send(error.message); } }) app.post("/reset-password/:id/:token", (req, res, next) => { const {id, token} = req.params; const {password, password2} = req.body; //check if this id exist in DB. if(id !== user.id){ res.send("Invalid ID...") return; } const secret = JWT_SECRET + user.password try{ const payload = jwt.verify(token, secret) //validate password and password2 should match. //we can simple find the user with the payload, email and id and finally update with new password. //always hash the password before saving. user.password = password res.send(user) } catch(error){ console.log(error.message); res.send(error.message) } res.send(user); }) app.listen(3000, ()=>{ console.log(`localhost:3000`) })```

[@mafiacodes]

That is an invalid url

[@khushboogoyal27]

@@mafiacodes but the code is exactly same as you have explained. can you plz share the source code of it?

[@khushboogoyal27]

@yoursTRULY now that error is gone and the code is working fine. but when i submit entries for password and confirm password it gives me some errors. although that page redirect to another page and displayed the desired data. it says this in my console - Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client at ServerResponse.setHeader (_http_outgoing.js:558:11) at ServerResponse.header (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:771:10) at ServerResponse.send (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:170:12) at ServerResponse.json (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:267:15) at ServerResponse.send (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:158:21) at /Volumes/khush/downloads/forgot-password/app.js:96:9 at Layer.handle [as handle_request] (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/layer.js:95:5) at next (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/route.js:137:13) at Route.dispatch (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/route.js:112:3) at Layer.handle [as handle_request] (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/layer.js:95:5)

[@editingtuto1.011]

Same problem is occurring with me too

[@suryakantkashyap2468]

Code link?

[@gamerminiax8901]

Great video but we need this with db.

[@mafiacodes]

easy to do, just follow the logic

[@Pravesh-Dwivedi]

Sir please make this video with db

[@suroya37]

if user1 have a link to reset password that I have, that mean user1 can reset password on my account ?

[@mafiacodes]

no each one can reset only his password

[@lazharimen1475]

great job

[@Codeforcessolutions]

Is this free

[@franciscob340]

Fala mais devagar moço, por favor. Tem criança chorando aqui

[@mafiacodes]

noted with thanks

[@bharanidharank1295]

hi

[@Vertex_17]

I'm getting "invalid id".... Actually I tried to use mongodb database for this.... I checked it, I'm getting the value of res.send(user.id).... but I'm not getting any value for res.send(id)... So it's not matching... Hence it is showing undefined What can I do for this problem?

[@dhanrajshinde8904]

Help me bro for my Instagram account I forget ten my password email is not working number is not working backup code are not working what can I do bro help me but my account is active I can't log in help me bro😢

[@crisluda22445]

this is hackable if I want to hack johndoe account it is easy to do so if I no johndoo id, I will reset my account and pass in john doe id in the URL and reset it. you are not verifying the token with the id.

[@saidiachref3014]

Thank you so much, this is so helpful