Recover / Reset lost password options via email

Question

I am working on a C# ASP.MVC 4 project making use of the DefaultMembershipProvider and I am trying to come up with a user friendly way to recover / reset a lost password. My first attempt was to have the user provide their username (which is a valid email address) the application would then generate a random password (meeting our requirements), that password is then emailed to the user. My ideal solution would be that when a user clicks the forgot password button. They are asked for their username which when provided would cause an email to be sent with a URL (this URL will also have an expiration date attached to it). This solution also resets the users password inside then application (before sending the email). When the user clicks on the URL, they are automatically logged in and sent to the change password form. Are there problems with this solution? For configuration I have the following values set: ```

Accepted Answer

First of all here are two must read [I repeat, MUST read]:

- Everything you ever wanted to know about building a secure password reset feature

- You're Probably Storing Passwords Incorrectly

With that said, OWASP has some guidelines about how to implement authentication, you can get started at their Authentication Cheat Sheet and for your particular case the Forgot Password Cheat Sheet. Which is also arguably a must read. If you are not going to follow OWASP, I hope it is because you decided to, and not because you didn't know any better.

Anyway, the best abstract is the image that follows (which is taken from the first link above), if you are going to remember only one thing, let it be this:

Recover / Reset lost password options via email

Solution

Problem

Related problems