Forgotten Password Throttling

Question

I have a "forgotten password" system that sends an email with a reset link to the user. Question: How can I prevent abuse of this system? How can I make sure that people don’t use it to spam people in boxes, but still use it for people who need it?

Answer 1

When a recovery email is sent, record the time at which it occurred. If during a given time interval (15 minutes? 6 hours? Per day?) There are any additional / too many recovery requests, print a message and do not send an email.

Answer 2

Request a registered email address, not a username? It is much less likely that the attacker will be known.

Alternatively, specify the TimeOfLastReset field in your users table and update it when you send the email. If CurrentTime-TimeOfLastReset is too small, then do not send.

Answer 3

1) ( ). 2) reset 3) reset ,

Answer 4

, .

( ), , .

, , . (disply: none) name="message" . , submit.

.

Answer 5

if you used the email address as the username for logging in, this should not be a big problem, as not everyone will know their email and the fact that in order for them to be reset, their email must match database. Therefore, it will be sent only and reset if someone enters a valid letter.