Forgot Password Service in Badgeyay
Badgeyay is an open source badge generator service for generating badges developed by FOSSASIA community for technical events and conferences. The project is divided into two components mainly frontend and backend. After creating the user registration functionality in application, if the user forgets the credentials for the login, then there must be a way to recreate the credentials using a secure channel. This is only valid for the users signed up through email login as for the case of OAuth they must have access to their ID on respective social platform. The main challenges in resetting password for the user is to provide a secure channel. So the problem can be breakdown into following issues: Creating a token for reset action Sending that token via mail to user Verifying that token on the server and giving access Changing the credentials of the user Procedure Generating token for the request to change credentials for the user. The token will be an expiry token and will be expired in the mentioned duration. So the token is valid for only a limited period of time and will prevent fraudulent requests. def pwd_reset_token(): data = request.get_json()['data']['attributes'] if 'email' not in data.keys(): print('Email not found') email = data['email'] user = User.getUser(email=email) if not user: return ErrorResponse(UserNotFound().message, 422, {'Content-Type': 'application/json'}).respond() expire = datetime.datetime.utcnow() + datetime.timedelta(seconds=900) token = jwt.encode({ 'id': user.id, 'exp': expire }, app.config.get('SECRET_KEY')) resetObj = ResetPasswordToken(user.id, token.decode('UTF-8')) resetObj.save_to_db() return jsonify(TokenSchema().dump(resetObj).data) Model for ResetPasswordToken class ResetPasswordToken(db.Model): __tablename__ = 'Reset Password Token' id = db.Column(db.String, primary_key=True) token = db.Column(db.String, nullable=False) def __init__(self, uid, token): self.id = uid self.token = token def save_to_db(self): try: db.session.add(self) db.session.commit() except Exception as e: db.session.rollback() db.session.flush() print(e) Sending the password reset link via mail to the user. The link will contain the token (expiry token) that will be used to validate the request. For the case we will be using Firebase Cloud functions as an HTTP Trigger. exports.sendResetMail = functions.https.onRequest((req, res) => { let token = req.query['token']; let email = req.query['email']; res.setHeader('Content-Type', 'application/json'); sendResetMail(token, email) .then(() => { console.log('Reset mail sent to', email); res.json({ data: { attributes: { status: 200 }, id: token, type: 'reset-mails' } }); return 0; }) .catch(err => { console.error(err); res.json({ data: { attributes: { status: 500 }, id: token, type: 'reset-mails' } }); return -1; }); }); function sendResetMail(token, email) { const mailOptions = { from: `${APP_NAME}<noreply@firebase.com>`, to: email, }; mailOptions.subject = `Password reset link`; mailOptions.html = '<p>Hey ' + email + '! Here is your password reset <a href=\'' + PASSWORD_RESET_LINK + token + '\'>Link</a><p>'; return mailTransport.sendMail(mailOptions); } Verifying the token on the server side to validate the user request def validate_reset_token(): args = request.args if 'token' in args.keys(): token = args.get('token') resp = {'id': token} try: jwt.decode(token, app.config['SECRET_KEY']) resp['valid'] = True return jsonify(ValidTokenSchema().dump(resp).data) except Exception as e: resp['valid'] = False print(e) return jsonify(ValidTokenSchema().dump(resp).data) After user has access to change the credentials, then user can send a POST request to backend through a form shown in UI to change its password. def changePwd():…
