Comprehensive Password Reset Security

1. Secure Token Generation and Storage

// Generate cryptographically secure tokens
const crypto = require('crypto');

function generateSecureToken() {
    // Create a 32-byte random token
    return crypto.randomBytes(32).toString('hex');
}

// Store tokens securely
async function createPasswordResetToken(userId) {
    const token = generateSecureToken();
    const hashedToken = crypto.createHash('sha256').update(token).digest('hex');
    
    // Store hash, not the actual token
    await db.tokens.insertOne({
        userId,
        token: hashedToken,
        createdAt: new Date(),
        expiresAt: new Date(Date.now() + 3600000), // 1 hour
        used: false
    });
    
    return token; // Return the actual token to be sent via email
}
        

2. Implement Proper Token Expiration and Rate Limiting

// Check token expiration
async function validateToken(userId, token) {
    // Hash the provided token for comparison
    const hashedToken = crypto.createHash('sha256').update(token).digest('hex');
    
    const tokenRecord = await db.tokens.findOne({
        userId,
        token: hashedToken,
        used: false,
        expiresAt: { $gt: new Date() }
    });
    
    return !!tokenRecord;
}

// Rate limiting implementation
const rateLimit = require('express-rate-limit');

const resetLimiter = rateLimit({
    windowMs: 60 * 60 * 1000, // 1 hour
    max: 3, // 3 requests per hour
    message: 'Too many password reset requests, please try again later.'
});

app.post('/forgot-password', resetLimiter, forgotPasswordHandler);
        

3. Secure the Password Reset Process Flow

1. Multi-Step Verification - Require additional verification for high-value accounts
2. Notification System - Notify users of password changes through multiple channels
3. Password Requirements - Enforce strong password policies during reset
4. Audit Logging - Log all password reset attempts with relevant metadata

// Example of a complete password reset flow
async function resetPassword(userId, token, newPassword) {
    // Validate the token
    if (!(await validateToken(userId, token))) {
        return { success: false, message: 'Invalid or expired token' };
    }
    
    // Validate the new password strength
    if (!isStrongPassword(newPassword)) {
        return { success: false, message: 'Password does not meet security requirements' };
    }
    
    // Change the password
    const hashedPassword = await bcrypt.hash(newPassword, 12);
    await db.users.updateOne(
        { _id: userId },
        {
            $set: {
                password: hashedPassword,
                passwordChangedAt: new Date()
            }
        }
    );
    
    // Invalidate the used token
    await db.tokens.updateOne(
        { 
            userId, 
            token: crypto.createHash('sha256').update(token).digest('hex') 
        },
        {
            $set: {
                used: true,
                usedAt: new Date()
            }
        }
    );
    
    // Log the password change
    await logSecurityEvent({
        userId,
        event: 'PASSWORD_RESET',
        ipAddress: requestIp,
        userAgent: requestUserAgent,
        timestamp: new Date()
    });
    
    // Send notification to user
    await sendPasswordChangeNotification(userId);
    
    return { success: true, message: 'Password reset successful' };
}
        

4. Additional Security Considerations

• HTTPS Only - Ensure all password reset links use HTTPS
• CSRF Protection - Implement anti-CSRF tokens on password reset forms
• Session Invalidation - Invalidate all active sessions after password reset
• Account Lockout Integration - Respect account lockout status during reset
• Secure Email Delivery - Configure SPF, DKIM, and DMARC to prevent email spoofing