So let's keep working on validating our sign you URLs so we can allow users to reset passwords.
And right now I'm looking at Mongo, which is in the CMD Web folder, the main entry point for our front
end.
And I know that I'm going to need both the URL to the front end and I'm going to need the secret key
that we specified in API Dutko.
So let's go over to API Dongo and copy that information.
So I'm going to want these two things, the command line flags.
And I'm also going to need to add in my config these two entries.
So let's go back to Mango and I'll paste that those two lines in here.
And it's really important that you use the same secret key here on the front end as you do in the back
end.
Otherwise, your validation is not going to work when you test the URLs authenticity.
And let's go back up here to our config and go back to API and we'll copy these two things from the
config type config and put it right back here and mango right at the end.
OK, so now I have that information available to me the next time I start my application.
Now let's go set up a route to the page which ultimately will display the password reset form.
So we'll go to rootstock go in the CMD Web folder.
And right here after the forgot password, I'll simply add another Getrude Muxtape get slash and the
user overused was reset password and this will go to a handler that will create in a minute after show
reset password.
OK, so let's go over to our handlers.
Don't go.
I'll just open up forgot password this way and then go to the very bottom and I'll create a new function
here.
A new handler func app pointed to application and we're going to call this one show reset password.
And of course, this is a handler.
So let's give it its two arguments.
OK, let's give ourselves some room here.
Now, what I want to do here, I know that my world is going to come to whatever my host is.
Whatever the world for this is, I think is a reset password and then two query parameters appended
on the end.
But the very first thing I want to do is to actually validate the euro and make sure that the one they're
going to is the one that's been signed.
And if it's not, we'll just do some show, some kind of error.
So first of all, let's get the euro.
The euro is a sign the value of our request euro or you are right.
There it is.
So that gives me the euro.
And the second thing I want to do is to create you are able to test to make sure that the one that they've
gone to is one that we've signed and they're allowed to be there.
So we'll go to create another variable test euro.
And that will be a sign the value of from the format package as print F and we'll just build the URL.
And all we need are two string placeholders like that.
And the first one is going to be the URL of our front end, which we just put in our app config, config
dot the front end.
And the second replacement is the URL that we just grabbed right here.
You URL and I probably should make those capital are in capital L because it is an acronym.
That works better.
So now that we have these, let's create a seiner variable, which is assign the value of from early
seiner, the package that we created, and we just give it its secret key, which we now have in our
app config after a secret key and convert it into a bite for me, just like it has to, which was very
helpful.
Now we'll see if it's valid.
Valid will be a boolean that we get back from seiner.
The variable we just created that gives us access to verify, token and verify token just needs test
Yoro.
So if it's valid, well let's just test this out.
If valid, I'll just say w dot.
Right and we'll make it a slice of bytes which it has to be valid.
That's right, slice of life envelop.
OK, so let's start our application.
I'll stop it first.
Make stop.
And started late start, let's give this a try.
So let's go back to our Web browser.
And as you can see here in Mantrap, my inbox is empty, so I've deleted all the emails that were there
before and I recommend that you do, too, just to make sure you're starting from a known state.
And I'll put in a valid email admin at example, dot com on my Facebook password for.
Which sends an email to mail trap and I'm going to mail trap.
And refresh this, and there it is.
OK, so it went to input widgets, dot dotcom, which is something we're going to have to fix because
that's not right.
First of all, let's just look at this email and let's see if it's valid.
So I'll click on it.
It should open a new browser window and check the signature.
And there it is valid, but let's go up here and say, I don't want to change admins password, I want
to change Trevor's password, just change that.
So I'm just changing you out and it immediately says invalid.
And if I change any single character anywhere in that euro, it just reports itself as invalid.
And that is exactly what I want to do.
So we have tamperproof you URLs.
And the great thing about this is that at no point up to sending this email have we done any database
lookups other than to verify that the email was actually valid when we when we received the submitted
form.
Everything else is just handled by cryptography and a tamper proof URL.
All right.
We'll move on in the next lecture.