Click here to Skip to main content
15,888,106 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
how to reset my loging password to send a link in a registred mail id. i.e. I have a web site now I want to create a code so that when I requested to change or reset my password it send a link to my mail id which is in my database or registered using asp .net C# code.
Posted
Comments
Sergey Alexandrovich Kryukov 16-Mar-15 12:08pm    
What is the problem here? Sending a mail (how could it be a problem?) or perhaps the whole scenario?
—SA
sudevsu 16-Mar-15 14:07pm    
he doesn't know where or how to start. that's his question.

1 solution

This takes a bit of work, but it's worth it.
First off, don't reset the password - do nothing with it immediately.
Then send an email (Easy: Sending an Email in C# with or without attachments: generic routine.[^])
The email contains the a message saying "We have received a password reset request on your account. If you requested this, click here: xxx If you didn't, do nothing" and providing a URL to a page, along with a unique code which accesses a DB table of requests. That page then asks the user to confirm, and if he does allows him to enter a new password.
If he doesn't click the link in 24 hours, the code expires and gets deleted in routine maintenance.
 
Share this answer
 
Comments
Richard Deeming 16-Mar-15 13:56pm    
You might also want to consider rate-limiting the reset emails, so an attacker can't make you bombard a user with messages.

Also, don't tell the user whether you've sent an email or not, since that would reveal whether the address was signed up to the site.

Troy Hunt has some good tips: Everything you ever wanted to know about building a secure password reset feature [^]
sudevsu 16-Mar-15 14:08pm    
5ed

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900