Password Reset links

Return to previous page

  • 4/7/2015
  • 3443 Views

Comments

3443 Views

Password Reset links

Last updated 4 years ago

Comments

Common

(Enter the content of this article below)

Advanced

 
At present when a new user registers or a user resets their password an email is sent containing the password. As SMTP uses cleartext this is not ideal. In addition, this only works when the password can be retrieved, which is possible for encrypted passwords but not hashed passwords (as hashing is a 1 way operation).
This enhancement add’s code to change the behavior when a user wants to reset their password. When they select that option an email is sent with a link to the password reset page. This link contains a value that is unique to that user. In addition, this link is only valid for a short period of time (determined by the “reset link timeout” value in host settings), and when used is no longer valid.
As well as showing on password registration mails, this same token is sent out for password resets –if the user requests a password reset the reset link timeout is used, if an admin/host user resets a users password then the token is valid for 24hrs.
To see this in action, create a user, and then log off. Click on login, and press the “reset password” button.

The following will appear

An email is sent out, and the user can click on the supplied link, re-enter their username and change the password.
Note: when an administrator does a “force password change” it no longer sends out a new, randomly generated password. Instead it sends out a password link – however as this action was initiated by the Administrator and not the user themselves this link is valid for 24hrs and not the usual (and much smaller) value set in host settings.
Subscribe to DNN Digest

DNN Digest is our monthly email newsletter. It highlights news and content from around the DNN ecosystem, such as new modules and themes, messages from leadership, blog posts and notable tweets. Keep your finger on the pulse of the ecosystem by subscribing.  


Copyright 2017 by DNN Corp Terms of Use Privacy
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out