"Forget your password" link and script

[lovinlazio9]

Just wondering the best way to go about making the whole Forget your password section of a site in terms of resetting the password..i guess the best way is to send an email with a link in it that allows the user to be redircted to a page that they can pick a new password....how do i make it safe though?

[bradgrafelman]

Just some random ideas:

• Allow them to create a security question & answer when the create an account.

• CONSTANT VIGILANCE

• Always use a "reset password" style - never spew out their old password (assuming you're actually storing unencrypted passwords... you're not, are you?)

• Include the person's IP in the e-mail message you send out... if users get e-mails they didn't ask for, they can forward the IP along to you.

• Hope your users don't allow their passwords and/or e-mail accounts to become compromised.

• CONSTANT VIGILANCE