Forgotten password in webapp

Question

I'm currently working on the administration pages for my website, and I've now reached a point where I'm starting to look at how a user can retrieve or be given a password if they forget the original.

I've not had to deal with anything like this before and I'm not sure which solution to use as there seems to be a number of ways to deal with this. So I thought I'd ask the more seasoned developers. What is the best method to deal with a 'Password Retrieval'

If it helps, when the user initially registers they have to provide an email address and password, which is then encrypted using salt.

Answer 1

I prefer to get the user to enter their email address and then:

a. Create a hash when the user submits the request and store it (which should expire after a certain amount of time - BloodyWorld).

b. The user is sent a link with that hash in.

c. They click the link which should go to a secure page on your site, you verify its valid making sure the hash you saved matches the one in the link then ask them to re-generate a password.

Answer 2

Well if you are hashing the password it can't be retrieved. You will have to create a temporary password and send it to the user. Have them then log in with the temporary password and then create a new one.