A Node.js password reset request endpoint should give the same response whether or not an account exists, throttle repeated requests, and leave the password unchanged until a valid, single-use, short-lived token is presented. The reset link goes to the address already on file, and the password changes only after that token validates. The steps below cover what to build at each stage and what to log.
Request endpoint: reveal nothing about which accounts exist
The OWASP Cheat Sheet Series’ Forgot Password Cheat Sheet makes the risk plain: “Even though this functionality looks straightforward and easy to implement, it is a common source of vulnerabilities, such as the renowned user enumeration attack.” A reset form that answers differently for a registered address and an unregistered one hands attackers a free account directory.
As an Amazon Associate I earn from qualifying purchases.
- Validate the identifier with the same input checks and injection prevention you use on other forms.
- Return one generic message for existing and nonexistent accounts, with the same status code and response shape.
- Make the timing match. Do comparable work on both branches so response time does not reveal which branch ran.
- Rate-limit per account, and add CAPTCHA where it fits your risk profile, so the endpoint cannot be used to flood a user’s inbox.
- Leave the account alone. A reset request should not lock, modify, or otherwise change the account. Nothing changes until a valid token arrives.
Generating and storing the reset token
A reset token is a credential, so treat it like a password for the duration of its validity. It must come from a cryptographically secure random source, be long enough that guessing is impractical, and be bound to exactly one user.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteStore only a hash of the token. OWASP’s testing guide identifies hashed storage as safer than plaintext, so a database leak does not hand over working reset links. A plain SHA-256 hash without a salt is adequate here because a 32-byte random token carries 256 bits of entropy and cannot be guessed from its hash. Passwords, which humans choose, need a slow password-hashing function; a random token does not.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
import crypto from 'node:crypto';
const token = crypto.randomBytes(32).toString('base64url');
const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
const expiresAt = new Date(Date.now() + 15 * 60 * 1000);
// Store tokenHash, userId, expiresAt, and usedAt = null.
// The raw token leaves the server only inside the emailed link.These calls come from Node’s built-in crypto module. Confirm the current behavior of randomBytes, the base64url encoding option, and createHash against the Node.js documentation for the version you run.
Building the reset link
The reset URL is a security boundary. Use HTTPS for the reset page and every endpoint it calls. Build the link from a configured origin or an allow-list of trusted domains, never from the incoming Host header, which a client can influence.
// APP_ORIGIN is a deployment setting, not a value read from the request.
const resetUrl = new URL('/reset-password', process.env.APP_ORIGIN);
resetUrl.searchParams.set('token', token);A token in a URL can leak through the Referer header and through third-party resources. On the reset page, send a no-referrer policy (the Referrer-Policy: no-referrer response header), and keep third-party scripts, images, and fonts off that page. Rate-limit submissions against the token as well, so an attacker cannot guess tokens by brute force.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
How long a reset link should stay valid
OWASP’s testing guide says a reset link should rarely be valid for more than an hour, and it also says the appropriate period depends on the site. Set your window from the risk and the user experience rather than copying a number.
- Account sensitivity. Administrative or financial accounts justify a shorter window than a low-privilege profile.
- Mail delivery time. A window shorter than your typical delivery delay will frustrate legitimate users, so measure delivery in your own environment.
- Shared inboxes. If many people can read the mailbox, a longer window increases exposure.
Whatever value you choose, store expiresAt with the token and enforce it at validation time. An expired link must fail even if the email is still sitting in the inbox.
Email delivery
Send the reset link to the address already registered to the account. The email is a side channel: the link is the reset mechanism, and you should never send a new or existing password. Keep the token out of the subject line, and avoid writing the full token-bearing URL into outbound-mail logs.
Rank #3
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
Review sender-domain authentication as part of the email path. OWASP’s testing guide names SPF, DKIM, and DMARC. Confirm all three are published and aligned for the domain that sends reset mail, and check your mail provider’s documentation for how it expects them to be configured.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteConfirming the token and completing the reset
The reset is complete only after a valid token has been presented. Work through these steps in order:
- Receive the token from the reset page and reject malformed input before any database lookup.
- Hash the submitted token and look up the record by hash.
- Check that the record exists, has not expired, and has
usedAtset to null. If any check fails, return the same generic failure message you use elsewhere and log the outcome. - Set the new password and mark the token as used in one database transaction, so two concurrent submissions cannot both succeed.
- Send a notification to the registered address that the password changed.
- Send the user to the normal sign-in page. Do not create a session or log them in automatically.
Audit logs for the reset lifecycle
OWASP’s Secrets Management guidance calls for tamper-resistant auditing with accurate timestamps. It lists events such as who requested a secret, approval or rejection, use and expiry, reuse attempts, authentication or authorization errors, updates, and administrative activity. OWASP does not supply a Node.js log schema, so the event names and fields below are an engineering recommendation adapted to the reset flow.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
- Reset requested
- Request throttled
- Token validation succeeded
- Token validation failed (with a non-secret reason code)
- Token expired
- Token reuse attempted
- Reset completed
- Notification queued or failed
Follow these safeguards when writing entries:
- Never log raw reset tokens, passwords, or full token-bearing URLs.
- Log a non-secret event identifier and the minimum account reference needed for an investigation.
- Record timestamps in UTC from a synchronized clock.
- Store logs where the application cannot rewrite them, such as an append-only store or a separate logging service.
Opaque tokens or JWTs
OWASP permits URL tokens and notes that JWTs are also possible, but warns that JWTs can introduce their own vulnerabilities. The two approaches are not equally simple. A random opaque token stored as a hash is the straightforward choice for reset links. Single-use enforcement needs server-side state either way, because the server has to record that a token was consumed. Choose JWTs only if you have a specific reason and have reviewed their failure modes.
Scope and terminology
OWASP’s guidance is platform-neutral. It does not depend on a particular Node.js framework, package, database, email service, or logging product, so adapt it to your stack. OWASP usually labels the user task “forgot password” and the server component a “Forgot Password Service”; search for those terms when you look for further guidance. Check the current OWASP pages before implementation, because the guidance is updated over time.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
