How should I implement "Forgot your password" in ASP.NET MVC?
asp.net-mvc, c#, membership
Solution
Based on the nature of the application, the Best practice for the forgot password should be in following order
- Allow the user to verify the Secret/Question for a maximum of 3 to 5 attempts
- On successful validation, Send an e-mail with random generated password with a validity of 24hrs.
- The e-mail must contain only the password but not both username/password.
- When user logs in with temporary password, then user must be forced to create a new password before going to home page.
Problem
I'm using the standard SqlMembershipProvider that comes with the ASP.NET MVC demo. I'm interested in implementing a "Forgot your password" link on my site. What is the correct way for this feature to be implemented? Should I overwrite the password with a temporary one and email it to their registered email?