MitchDrage commented on issue #13604:
URL: https://github.com/apache/cloudstack/issues/13604#issuecomment-6758613224
I had a think about this and I still believe most implementations would
issue a new token on each request.
1. Issuing a new token rotates the token and resets the expiry together.
Resending the existing token requires that we either:
Keep the original expiry, which is confusing if the user asks
near the end of the window as the link may only work for a few minutes, or
Reset the expiry, which lets a single token live
indefinitely, provided the rate limit allows it.
2. OWASP says reset tokens should be "stored in a secure manner, as
discussed in the Password Storage Cheat Sheet"
(https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html#general-security-practices),
which recommends hashing. The token is currently stored in plaintext in
user_details. I wouldn't change that under this issue, but if it ever moves to
a hash we couldn't resend the existing token.
Raising a PR for option 1.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
