我怎样才能“过期”？数据库记录中的更改密码唯一代码？
我想在我的 java web 应用程序中实现忘记密码功能。我想这样实现：
- 用户输入他们的帐户电子邮件地址并按“忘记密码”按钮
- 应用程序生成一个唯一的字符和数字代码，并将其作为参数的链接发送到用户的电子邮件地址
- 用户单击该链接，然后他们会出现一个表格，他们可以在其中输入新密码
我想要做的是确保链接（即唯一代码）在用户按下忘记密码按钮一小时后“过期”，这样，如果攻击者获得了对其的访问权限，电子邮件帐户 除非他们在第一个小时内获得访问权限，否则此链接将不起作用。
我不知道如何使数据库“过期”或清除用户帐户记录的代码。我怎样才能实现这个？
I want to implement a forgot password function in my java web application. I want to implement it like this:
- User enters their account email address and presses 'forgot password' button
- App generates a unique code of characters and numbers and sends a link with that as a parameter to the user's email address
- User clicks the link and they are presented with a form where they can enter their new password
What I want to do is ensure that the link (i.e. the unique code) 'expires' an hour after the user presses the forgot password button so that if an attacker gains access to their email account this link won't work unless they gain access in that first hour.
I don't know how to make the database 'expire' or clear the code for the user's account record. How could I implement this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
将
ValidUntil列添加到包含代码的表中，并在让用户更改密码之前对其进行检查。Add a
ValidUntilcolumn to the table containing the code and check against that before letting the user change the password.您将生成唯一代码的日期存储在数据库中。当用户单击链接时，如果自生成唯一代码以来超过了允许的时间，则不允许他们更改密码。
You store the date in the database that the unique code was generated. When the user clicks on the link, if it is more than the allowed time since the unique code was generated, you do not let them change the password.