So we're not quite done with resetting passwords.
One very common security practice is to ensure that when you send a password, reset email or text or
whatever it may be, that you have some expiry that it's only good for, let's say, 60 Minutes.
And we're not doing that right now.
And it's really easy to implement that.
It requires only a few lines of code.
So in handlers don't go in the function.
So reset password, the part where we're showing the page that lets them reset their password.
All we have to do here is add another check.
So after we make sure the token is valid, we'll say make sure not expired and we'll make it 60 Minutes.
So I'm going to call a function in that sinor package that we created you earlier, our package, and
it's the one that checks the expiry.
So I'll create a variable called expired and I'll call SINOR expired and handed our token, which in
our case is test you, Earl, you are visiting and we want to make sure that no more than 60 Minutes
have gone by.
So if this comes back true, then it's expired.
So if it expired and I'll just do the same thing I did here, I'll just print out a message to our console
and I will return.
And of course, you could redirect to an error message page or whatever you wish, but I'll just say
link expired, OK?
And literally, that's all we have to do in this case.
So when we send that email out, of course, we should actually send some text that says this link is
good for only good.
Only 60 Minutes.
So also, this link expires in 60 minutes, and I'll just copy that and put it in the other version
of our email, which is the HTML one right here.
Was that I should have a closing tag here somewhere?
Yes.
And I'll put another paragraph with the same text, and that takes care of it.
All right.
We're not quite finished, though.
There's one other thing we probably should take into account.
So if I look at the reset password page at the very bottom in this JavaScript function, Val, we're
putting in the payload the email and we're just putting in the email address that's to be changed.
The one that's associated with the user whose password we want to reset now, a malicious user who examines
the source code for this password reset page could say, oh, all I have to do is change the email in
this payload variable.
And I can change somebody else's password and we need to take care of that, and there are many, many
ways of doing so, but we can't use a really conventional approach, which is to stick it in session
because the session for our front end exists only for our front end and we have no access to it from
the back end.
So one easy approach to take care of this is something that will actually be useful in other situations
as well.
We can encrypt that email to a text value, a long string of characters that appear to be random.
So we encrypt it when we write it to this page and when we get the payload on the back end, we decrypt
it.
So we'll take care of that in the next lecture.