Question about 'Patterns for handling users'

[VishKozus]

Hi Rpicard,

Your book is very good, I learn a lot from your Explore Flask series.

I have a question about 'Patterns for handling users' chapter. In this chapter, we only use expire time to ensure safety. But if user's email account was stolen in the expire times, then the one who stole our user's email account can access user's account or change user's password in our website.

Is there any way to make the token can be used only once?

Thanks you.

[rpicard]

@VishKozus You're correct. If the user's email is taken over between the time they use the token and the time it expires, the attacker would still be able to use it. To ensure the token is only used once, you could store it on the back-end (e.g. in a database of some kind) and mark it as invalid once it has been used.

Keep in mind though, that if a user's email is taken over, the attacker can always go to your website and request a new password reset token, so you don't gain any meaningful security.

[VishKozus]

@rpicard
thank you! I got it !