Published 19 years 2 months ago • Last updated March 22, 2025 • ⏱️ 3 min read
I've been writing an email web application recently and I have been thinking about making the forgotten password feature more secure as it is often the easiest avenue for an attacker to get into your web site. The major issue with these features is information disclosure, for example if you have an email account as the username for your web site, the attacker simply enters random email addresses to see which ones are valid accounts depending on the responses from your web site.
So you have to be very careful with the error messages you display and only give the smallest amount of information you can. I see many web sites on the internet display more than they should, if you enter an invalid username or password some web sites are very specific with the error message e.g. "Invalid username" or "invalid username and password", over the years I've learnt when developing my applications to be careful with this information, my error messages will often say "Invalid username or password", it sounds insignificant but it can make a real difference in improving your overall security of your web site as these little items tend to add up.
This isn't easy because it is a balance of ease of use and security, getting them both spot on is a real challenge. I decided to abandon the use of an email to login to my application and instead provide a username. When requesting a password reset, a username and email combination is required before the email confirmation will be sent. This reduces the risk mentioned earlier where an attacker can see which accounts are valid by guessing the email address, as they now require two pieces of information.
Once they have entered their username and email combination the site would then check if that combination exists in the table. If the username or email doesn't exist the site would display a generic error message "Email could not be sent please check your username or email and try again", thus providing enough information for the user but not giving away too much.
When they enter the correct username and email; an email is then generated with a secure one-time hash that will expire. The hash is a long sequence of characters with a salt [1], which is stored in the table for that user. When clicking on the link the user is presented with a confirmation page that requests the username and email again to provide protection against brute force attacks against the hash. Once the hash, username and email have been confirmed the site can then reset the password.
If you use MD5 in PHP and find that the url is too long, a good tip is to simply follow the process above for creating and checking the hash but then use substr() function in PHP to reduce the length of your hash. So you take a standard hash "098f6bcd4621d373cade4e832627b4f6" and reduce it, the code below takes the hash and starts at position 5 and takes 5 characters from that to produce our unique string with only 5 characters. You can then choose which position to start from and how many characters you would like, just make sure the number of characters you request doesn't exceed the length of the hash.
$start = 5;
$length = 5;
echo substr("098f6bcd4621d373cade4e832627b4f6", $start, $length);