How to handle forgot password to reset password using a one-time link.
ฝัง
- เผยแพร่เมื่อ 10 ก.พ. 2025
- In this video you will learn the logic of handling #forgot-password, to send the user a #one-time link to #reset-password, it uses #JWT to create onetime password reset links.
FREE $100 credit @Digital Ocean: m.do.co/c/3208...
Subscribe: www.youtube.co...
Support the channel:
Paypal: www.paypal.me/...
Patreon: / trulymittal
⭐ Kite is a free AI-powered coding assistant that will help you code faster and smarter. The Kite plugin integrates with all the top editors and IDEs to give you smart completions and documentation while you’re typing. I've been using Kite for 6 months and I love it! www.kite.com/g...
---------------
Other useful Playlists
---------------
#RestAPI (#NodeJS and MongoDB): • REST API using NodeJS ...
#API Authentication using #JWT: • NodeJS API Authenticat...
#Firebase: • Firebase | Build a Not...
Docker: • Docker
MongoDB: • Learn MongoDB in 50 mi...
Html/Css/Js: • HTML / CSS / JS
Android: • Android
Challenges: • Challenges
#yoursTRULY #tutorial #howto #nodejs #android
I really loved your explanation. It was straight to the point, without any unnecessary bullshit. Plain, simple, and easy to follow for resetting the password. Good job!
Ahh thank you so much! I've been looking for this for almost a week. The other videos on YT all use randomly generated crypto tokens, but I wanted to use JWT instead. This was a life saver, and very well explained. Thanks again man!
really loved the tutorial, it's perfect how you only focus on the topic and not other things. Thanks a lot.
Your explanation is soo good
Glad it was helpful!
One suggestion for all.
Instead of generating jwt secret using a secret key+user old password, use crypto to generate a new secret key each time user wants to reset the password and store the secret key in your database. When user successfully resets the password, just delete the secret key from database so that it cant be used again.
Thank you !
best video in the youtube for the reset password technique
Thanks for the video! It's easy to learn. I like the way you skip the unimportant part and only focus on password reset!
I like the way we can leverage JWT to create a token which helps us to create one-time link. Useful tutorial!
This is so frickin' clear. Thank you pal!!!
Right on the point and so clear thank you so glad I'v found this channel man keep it up
Thanks for providing such a clear tutorial on how to do this. Much appreciated!
Bro you are my superman, for my deadlines
Subscribe like share
@@mafiacodes yes
Amazing video bro , simple and clear explanation
Glad it helped
Please provide a link to the code in the description. That would be awesome.
Hi, thank for this awesome tutorial. Just I'm curious if there is any repository with the code from your example?
Love these node tutorials
Please provide a link to the code in the description. That would be awesome. Thanks :D
your videos are of very high quality.
I appreciate that! Thank you!
This was excellent, thank you!
Clear and simple. Thanks my friend
Thanks you so much for this video.. thanks to you i have able to complete this authentication part smoothly. I find many challenges when using the same code with database but little by little debugging finally i happen to get to the same result.. Your content is really worked with real case scenario. I really appreciate the time and effort you took to explain the process concisely.
Thanks this helps me a lot..
Subscribe like share
Great video! Subscribed to channel. Thank you.
So, I have watched it earlier today. By now I have watched it second time and implemented into my project without any hussle whatsover! The quality of your tutorial is better than many I have watched on udemy. They usually talk to much or not clear enough. Your explanation was perfect, step by step, easy to replicate in any project. Thank you a milion again sir!
Thanks this tutorial very helpfull
thank you sir easy explanation af
Thank you so much, it really helped me!
Superb 🔥🔥
Thank you, very clear explanation
Thankyou much ))
Thanks brother
thanks you for your clear explanation , i have a doubt regarding where the token is storage in the project , is into cache?
amazing channel
Thank you so much
Very informative. Thanks⚡️
Which font you are using can you please tell me?
Thank you. This videao is very helpful.
Great tutorial ❤️
help alot....
It is not one-time link if the user sets exactly the same password. It should've been generated private key, stored on distributed fs or memory until user changed their password. Once done you remove the key. Obviously you need to have a dedicated authorization mechanism just for this endpoint.
Can you tell me what font is used in Vs code ?
Good Work Bro Keep It Up Bro Can u plz provide the source code
I'll check if I have saved it...
Fantastic video, congratulations. Could you tell me what vscode theme you were using?
Snazzy operator
you're my pal
awesomeeeeee......
tks so much
great video as always
please also make videos on MERN full stack videos
Great explanation, thank you very much!!
Is it best practice to use the current password for the jwt secret in this way? I get that the secret is never sent to the client, but it still feels like it might be a an unnecessary risk. I'd be interested to know your thoughts.
No problem at all, moreover it’s more secure since we are creating a secret using a common secret and hashed password , so no worries with that
Its safe to use it.. because your current password is hashed and u r using that hash plus jwt secret so no one can decode it.. even if u get hashed password text u can't get password from it.. it is secure
Thanks for tutorials! really helpful.
If the user re-enters the old password, then the token will still be valid until it expires, right?
Can we send email of the user in the url apart from id of the user
Btw great content :-)
Thanks, Bro! It helps a lot 👍☺
I have one question. Can a similar approach be taken for user's email validation when a user signs up? Great video. Thanks a lot.
Yes, absolutely
@@mafiacodes Thanks a lot for the reply.
I did the signup process with jwt. With an email validation to activate account.
you can check the signs-up email address on the user table on the database. If the email already exists, an error message can show." this email already registered", otherwise signs up will continue.
How do I get the user from the database from the reset password link? We didn't need a request.body
Does this work on iOS or do we have to use universal links ?
Which vscode theme color do you use?
nice video,please make video on otp based login system
Yeah coming up
@@mafiacodes when it will come sir?waiting for it
Awesome
Sir hello one time paasword means if you failed to use the first otp that google send...google will not send another otp again???..is that mean of otp....or they send again?? but in some other time or day??.because i reiceve my otp but accidentally i cancel my request for reset password link .then i fill up again in google recovery form and option to submit not show again..is it because i failed to use my first code???how can i get again... hope you answer me..thank you sir
For some reason jwt verify is returning false , basicaly it's not working
Fala mais devagar moço, por favor. Tem criança chorando aqui
noted with thanks
please how can i set it to get the email and password in my database
Great video but we need this with db.
easy to do, just follow the logic
Sir please make this video with db
Pls can you share your vs code profile i like your extensions
Suppose my boss is giving me existing code written by others, now they provide me their api..now how to test and properly integrate in frontend (.ejs) ..can you make a video on this topic
sir what if i am using env variable for JWT secret key and not not using password in the secret like you did only using the env variable for storing secret will it give invalid signature
U can only use env variable but in that case the link will be valid for lifetime of the token even if it has been used once to reset a password
@@mafiacodes so i will have to use the password with jwt secret for not use it more than one time once it is used
Yes
That was awesome, I was looking for this kind of answer, how to generate unique token regarding the reset password, to not be valid after the process.
I have one doubt. Like during sign up i store token in database.. so is again need to generate token for reset password or i fetch from database??
Please reply as early as possible. It would be great help!
u have to watch the full video to understand how it works, it has nothing related to signups...
The token is never stored, only generated and saved in the client side (maybe in your mailbox)
Sir I tried with database but not working please help me with this problem.
great job
Link to source? Will help in debugging errors. Thank you
I will
@@mafiacodes Thanks bro
does have any git repo??
where can i find the source code
where is your git
What if the user resets his password and then later changes it back to the old one? Does the old link then become valid again? Your solution is trash.
He don't show hashing part ,
Use bcrypt to hash password before saving it he will add some salt to it , so even if two password is same there hash will be completely different
if user1 have a link to reset password that I have, that mean user1 can reset password on my account ?
no each one can reset only his password
@yoursTRULY it says "Cannot GET /reset-password/qwerty12".
```const express = require("express");
const jwt = require("jsonwebtoken");
const app = express();
app.use(express.json());
app.use(express.urlencoded({extended: false}))
app.set("view engine", "ejs")
let user = {
id: "qwerty12#45",
email: "k@gmail.com",
password: "qwer123@#$fghj"
}
//To create a token we need secret.
const JWT_SECRET = "some super secret..."
app.get("/", (req, res) => {
res.send("Hello World!")
})
app.get("/forgot-password", (req, res, next) => {
res.render("forgot-password");
})
app.post("/forgot-password", (req, res, next) => {
const {email} = req.body;
//res.send(email);
//make sure user exist in DB.
if(email !== user.email){
res.send("User not registered")
return;
}
//user exist and now create one time link that is valid for 15 mins.
//we need to create one more secret because we dont want that user can use the same link even after 15mins completed.
const secret = JWT_SECRET + user.password;
//this payload will be stored inside our JWT token.
const payload = {
email: user.email,
id: user.id
}
const token = jwt.sign(payload, secret, {expiresIn: "15m"});
//generating link through this token.
const link = `localhost:3000/reset-password/${user.id}/${token}`;
console.log(link);
//we can use transactional emails here.
res.send("Password reset link has been sent to your email.");
});
app.get("/reset-password/:id/:token", (req, res, next) => {
const {id, token} = req.params
//check if this id exist in DB.
if(id !== user.id){
res.send("Invalid ID...")
return
}
//we have a valid id and we have a valid user with this id.
const secret = JWT_SECRET + user.password;
try{
const payload = jwt.verify(token, secret)
res.render("reset-password", {email: user.email})
} catch(error){
console.log(error.message);
res.send(error.message);
}
})
app.post("/reset-password/:id/:token", (req, res, next) => {
const {id, token} = req.params;
const {password, password2} = req.body;
//check if this id exist in DB.
if(id !== user.id){
res.send("Invalid ID...")
return;
}
const secret = JWT_SECRET + user.password
try{
const payload = jwt.verify(token, secret)
//validate password and password2 should match.
//we can simple find the user with the payload, email and id and finally update with new password.
//always hash the password before saving.
user.password = password
res.send(user)
}
catch(error){
console.log(error.message);
res.send(error.message)
}
res.send(user);
})
app.listen(3000, ()=>{
console.log(`localhost:3000`)
})```
That is an invalid url
@@mafiacodes but the code is exactly same as you have explained. can you plz share the source code of it?
@yoursTRULY now that error is gone and the code is working fine. but when i submit entries for password and confirm password it gives me some errors. although that page redirect to another page and displayed the desired data. it says this in my console -
Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client
at ServerResponse.setHeader (_http_outgoing.js:558:11)
at ServerResponse.header (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:771:10)
at ServerResponse.send (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:170:12)
at ServerResponse.json (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:267:15)
at ServerResponse.send (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:158:21)
at /Volumes/khush/downloads/forgot-password/app.js:96:9
at Layer.handle [as handle_request] (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/layer.js:95:5)
at next (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/route.js:137:13)
at Route.dispatch (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/route.js:112:3)
at Layer.handle [as handle_request] (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/layer.js:95:5)
Same problem is occurring with me too
hi
I'm getting "invalid id".... Actually I tried to use mongodb database for this.... I checked it, I'm getting the value of res.send(user.id).... but I'm not getting any value for res.send(id)... So it's not matching... Hence it is showing undefined
What can I do for this problem?
Code link?
Is this free
Help me bro for my Instagram account I forget ten my password email is not working number is not working backup code are not working what can I do bro help me but my account is active I can't log in help me bro😢
this is hackable if I want to hack johndoe account it is easy to do so if I no johndoo id, I will reset my account and pass in john doe id in the URL and reset it. you are not verifying the token with the id.
Thank you so much, this is so helpful