backendenhancementhelp wanted
Métriques du dépôt
- Stars
- (3 443 étoiles)
- Métriques de merge PR
- (Aucune PR mergée en 30 j)
Description
Summary
Since we removed email-based forgot password flows (see git log for original code), we should add an alternative system for password resets. One way to do this is with "recovery tokens", as seen on sites with MFA flows. We could give a user one recovery token which can be used to validate a one-time password reset, which then grants a new recovery token. These could be stored as (user_id, token) in a new Postgres table, and can be deleted after successful use.