I've been searching around the web for best practice how-to on secure password reset system (email with reset url), and the idea to hash the token in the database, which I did not implement at first, seems to be the the most secure way to store the token.
Im currently following this guide, and he does not mention it (why?)
Im using bcrypts for password hashing allready, so thats what im using for this aswell.
How ever, the syntac for the verify is like this: Bcrypt.verify(non-hash, hash);
So my question is this: If the reset-link only contains the token (which is not in db, the hash is) - how can I find the user in the db?
is it safe to append email/userID to the reset-link as well? None of the other services Ive seen have does this (afaik), only the token (do they not hash the token in the db?).
I dont want to make my own scheme that will create a security issue, so how do I proceed with this ?
Using asp.net web forms and c#