Creating a Password Reset Workflow

Design the reset lifecycle around a hashed token, bounded expiry and an atomic one-time redemption.

The objective is to understand the behavior and operational limits, not only the method name.

What It Does

Design the reset lifecycle around a hashed token, bounded expiry and an atomic one-time redemption.

Prerequisites

Use a dedicated development environment and sample data. Where a snippet uses an injected connection, repository, request value or mailer, supply it from your own application setup.

Example 1: Basic Use

A focused working pattern for this topic. Names such as $pdo, $authContext and $repo represent dependencies provided by the application unless initialized in the snippet.

<?php
$tokenHash = hash('sha256', $tokenFromRequest);
$pdo->beginTransaction();
try {
    $stmt = $pdo->prepare('SELECT user_id FROM reset_tokens WHERE token_hash = ? AND expires_at > CURRENT_TIMESTAMP AND used_at IS NULL FOR UPDATE');
    $stmt->execute([$tokenHash]);
    $userId = $stmt->fetchColumn();
    if ($userId === false) throw new RuntimeException('Invalid reset request');
    $pdo->prepare('UPDATE users SET password_hash = ? WHERE id = ?')->execute([password_hash($newPassword, PASSWORD_DEFAULT), $userId]);
    $pdo->prepare('UPDATE reset_tokens SET used_at = CURRENT_TIMESTAMP WHERE token_hash = ?')->execute([$tokenHash]);
    $pdo->commit();
} catch (Throwable $e) { if ($pdo->inTransaction()) $pdo->rollBack(); throw $e; }

Example 2: A Second Scenario

A second use case that adds a different operation or data flow specific to this topic.

<?php
$secret = bin2hex(random_bytes(32));
$pdo->prepare('INSERT INTO reset_tokens (user_id,token_hash,expires_at) VALUES (?,?,?)')->execute([$userId,hash('sha256',$secret),gmdate('Y-m-d H:i:s',time()+900)]);

Example 3: Practical Checks

A practical validation, failure or deployment concern specific to this topic.

<?php
$hash = password_hash($newPassword,PASSWORD_DEFAULT);
$stmt = $pdo->prepare('UPDATE users SET password_hash=? WHERE id=?');
$stmt->execute([$hash,$userId]);
$pdo->prepare('DELETE FROM reset_tokens WHERE user_id=?')->execute([$userId]);

Important Behavior and Edge Cases

Password resets must invalidate the token and active sessions; protect forms from CSRF and rate-limit requests.

For production use, also account for error handling, data validation, resource limits and environment-specific driver behavior.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Design the reset lifecycle around a hashed token, bounded expiry and an atomic one-time redemption.
• Password resets must invalidate the token and active sessions; protect forms from CSRF and rate-limit requests.
• Use this workflow as a focused starting point rather than a substitute for application-level tests.

Choose this API or pattern when its exact semantics match your task, and verify the result against the database driver and runtime used by your application.