Password reset email pattern in Flask

Introduction

We use a password reset email pattern to help users safely change their forgotten passwords. It sends a special link to their email so only they can reset their password.

When a user forgets their password and needs to create a new one.

When you want to improve security by verifying the user's email before changing the password.

When you want to provide a smooth way for users to regain access without contacting support.

Syntax

Flask

from flask import Flask, request, url_for
from itsdangerous import URLSafeTimedSerializer

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'

serializer = URLSafeTimedSerializer(app.config['SECRET_KEY'])

def generate_reset_token(email):
    return serializer.dumps(email, salt='password-reset-salt')

def verify_reset_token(token, expiration=3600):
    try:
        email = serializer.loads(token, salt='password-reset-salt', max_age=expiration)
    except Exception:
        return None
    return email

The URLSafeTimedSerializer creates a token that expires after some time.

Use the same salt value when generating and verifying tokens.

Examples

This creates a token for the email '[e-mail]'.

Flask

token = generate_reset_token('[e-mail]')
print(token)

This checks if the token is still valid and prints the email if it is.

Flask

email = verify_reset_token(token)
if email:
    print(f'Token valid for {email}')
else:
    print('Token invalid or expired')

Sample Program

This program creates a reset token for a user email, prints a reset link with the token, then simulates verifying the token when the user clicks the link.

Flask

from flask import Flask, request, url_for
from itsdangerous import URLSafeTimedSerializer

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'

serializer = URLSafeTimedSerializer(app.config['SECRET_KEY'])

def generate_reset_token(email):
    return serializer.dumps(email, salt='password-reset-salt')

def verify_reset_token(token, expiration=3600):
    try:
        email = serializer.loads(token, salt='password-reset-salt', max_age=expiration)
    except Exception:
        return None
    return email

# Simulate sending reset email
user_email = '[e-mail]'
token = generate_reset_token(user_email)
print(f'Reset link: http://example.com/reset_password/{token}')

# Simulate user clicking the link later
received_token = token
verified_email = verify_reset_token(received_token)
if verified_email:
    print(f'Token valid for {verified_email}')
else:
    print('Token invalid or expired')

Important Notes

Always keep your SECRET_KEY safe and secret.

Tokens should expire to prevent misuse.

Send the reset link via email securely and avoid showing tokens in URLs publicly.

Summary

The password reset email pattern helps users safely reset forgotten passwords.

It uses a token that expires to verify the user's identity.

Flask with itsdangerous makes creating and checking tokens easy.