Solution: Offline Password Reset using One-Time Codes
Solution: Offline Password Reset using One-Time Codes
1. User Request: When a user forgets their password, they provide their email ID and click on the "forget password" link.
2. Token Generation: The "forget password" link generates a unique token and records it along with the user's email in a "forget password token" table. It also starts a 5-minute timer for this token.
3. User Redirected: The user is then redirected to the "forget password" page and request to enter the token in the token field(to ensure the user).
4. Password Reset: The user uses the one-time reset code to reset their password through a physical interface. (e.g., a dedicated kiosk)
5. User Input: On the "forget password" page, the user is asked to enter their email ID, a new password, and confirm the new password.
6. Token Validation: When the user clicks the submit button, the system checks if the entered email matches any entry in the "forget password token" table.
7. Time Check: If the email is found in the table and the 5-minute timer hasn't expired, the system allows the user to reset their password.
8. Password Reset: If the token is valid and not expired, the user can reset their password.
9. Request for Entry: If the email is not found in the "forget password token" table or the token has expired, the system prompts the user to request a new "forget password" token.
Comments
Post a Comment