Flask-Login Password Reset

Question

I'm using the flask-login library, and I haven't been able to find any good tutorials or documentation on how to go about allowing a user to reset their password through an email. What direction/resources can I look at on how to do this? A thorough google search didn't reveal anything useful.

Answer 1

Base logic:

1. Create reset password form with email field.
2. When user submit form then you should:
   1. check this email in database
   2. generate undistinguished crypto random secret key (next just secret key)
   3. store this key, current timestamp and user identifier to cache or database
   4. send it to user email or sms
3. When user apply secret key (for example with url or special form) you should:
   1. validate it (exist, not expired, not used before)
   2. get user identifier
   3. delete or mark as used current secret key
   4. provide logic to enter/generate new password.

Logic to enter/generate password can be different:

1. login user and show form to enter new password - one time login key
2. show form to enter password than login if valid
3. generate new password and send it to user email
4. generate new secret key for form to enter new password and send it to user email
5. generate new secret key to approve form, send it via sms, show form to enter new password and approval secret key then login if valid