Password reset email pattern in Flask - Step-by-Step Execution

Concept Flow - Password reset email pattern

User requests password reset

↓

Generate secure token

↓

Create reset URL with token

↓

Send email with reset link

↓

User clicks link

↓

Verify token validity

↓

Show reset form

↓

User submits new password

↓

Update password in database

↓

Confirm success to user

This flow shows how a password reset email is generated, sent, and used to securely reset a user's password.

Execution Sample

Flask

from flask import Flask, request, url_for
from itsdangerous import URLSafeTimedSerializer

app = Flask(__name__)
app.config['SECRET_KEY'] = 'secret!'

serializer = URLSafeTimedSerializer(app.config['SECRET_KEY'])

def send_reset_email(user_email):
    token = serializer.dumps(user_email, salt='password-reset-salt')
    reset_url = url_for('reset_password', token=token, _external=True)
    print(f"Send email to {user_email} with link: {reset_url}")

This code generates a secure token for the user's email and prints a reset link simulating sending an email.

Execution Table

Step	Action	Input	Output	Notes
1	User requests password reset	[e-mail]	[e-mail]	User submits email to reset
2	Generate token	[e-mail]	token_string	Token created with serializer.dumps
3	Create reset URL	token_string	https://host/reset_password?token=token_string	URL includes token as query param
4	Send email	reset URL	Email sent with reset link	Simulated by print statement
5	User clicks link	token_string	Token received by server	Server gets token from URL
6	Verify token	token_string	[e-mail] or error	Token decoded or invalid
7	Show reset form	valid token	Password reset form displayed	User can enter new password
8	User submits new password	new_password	Password updated	Password saved in database
9	Confirm success		Success message shown	User notified of reset
10	Invalid token case	invalid or expired token	Error message shown	User informed token is invalid

💡 Process ends after password reset success or invalid token error

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 6	Final
user_email	None	[e-mail]	[e-mail]	[e-mail]	[e-mail]
token	None	token_string	token_string	token_string	token_string or error
reset_url	None	None	https://host/reset_password?token=token_string	https://host/reset_password?token=token_string	https://host/reset_password?token=token_string
password	None	None	None	None	new_password (updated)

Key Moments - 3 Insights

Why do we use a token instead of sending the email directly?

The token securely encodes the user's email and expiry info, so the server can verify the reset request later (see Step 2 and Step 6 in execution_table).

What happens if the token is invalid or expired?

The server shows an error message and does not allow password reset (see Step 10 in execution_table). This protects user accounts.

Why do we include the token in the URL?

Including the token in the URL lets the server identify and verify the reset request when the user clicks the link (see Step 3 and Step 5).

Visual Quiz - 3 Questions

Look at the execution_table, what is the output at Step 3?

A A reset URL containing the token

B An error message

C The user's new password

D The user's email address

💡 Hint

Check the Output column for Step 3 in execution_table

At which step does the server verify the token validity?

A Step 2

B Step 6

C Step 8

D Step 10

💡 Hint

Look for 'Verify token' action in execution_table

If the token is invalid, what does the server do according to the execution_table?

A Show password reset form

B Send another email

C Show error message

D Update password anyway

💡 Hint

See Step 10 in execution_table for invalid token handling

Concept Snapshot

Password reset email pattern in Flask:
- User requests reset with email
- Generate secure token with serializer
- Create URL with token
- Send email with reset link
- User clicks link, server verifies token
- Show reset form if valid
- Update password on submission
- Handle invalid/expired tokens with error

Full Transcript

This visual execution trace shows how a password reset email pattern works in Flask. First, the user requests a password reset by providing their email. The server generates a secure token encoding the email and creates a reset URL containing this token. This URL is sent to the user via email. When the user clicks the link, the server receives the token and verifies its validity. If valid, the user sees a form to enter a new password. After submission, the password is updated in the database and the user is notified of success. If the token is invalid or expired, the server shows an error message and does not allow the reset. This process ensures secure password resets without exposing sensitive data.

Practice

1. What is the main purpose of using a token in a Flask password reset email pattern?

easy

A. To securely verify the user's identity before allowing password reset

B. To store the user's new password temporarily

C. To send the user's password in plain text via email

D. To log the user out of all sessions automatically

Solution

1. Step 1: Understand the role of tokens in password reset

   Tokens are unique codes sent to users to confirm their identity securely during password reset.

2. Step 2: Identify the purpose of the token

   The token ensures only the rightful user can reset the password by verifying their identity.

3. Final Answer:

   To securely verify the user's identity before allowing password reset -> Option A

4. Quick Check:

   Token = Secure identity verification [OK]

Hint: Tokens verify identity safely before password changes [OK]

Common Mistakes:

• Thinking tokens store passwords
• Assuming tokens send passwords in email
• Believing tokens log users out

2. Which of the following is the correct way to create a timed token using Flask's itsdangerous library?

easy

A. token = URLSafeTimedSerializer.dumps(secret_key, email)

B. token = URLSafeTimedSerializer(secret_key).loads(email)

C. serializer = URLSafeTimedSerializer(); token = serializer.dumps(secret_key, email)

D. serializer = URLSafeTimedSerializer(secret_key); token = serializer.dumps(email)

Solution

1. Step 1: Recall the correct usage of URLSafeTimedSerializer

   It requires initializing with a secret key, then calling dumps() with the data to encode.

2. Step 2: Match the syntax to the correct option

   serializer = URLSafeTimedSerializer(secret_key); token = serializer.dumps(email) correctly creates the serializer and calls dumps(email) to create the token.

3. Final Answer:

   serializer = URLSafeTimedSerializer(secret_key); token = serializer.dumps(email) -> Option D

4. Quick Check:

   Serializer + dumps(data) = token [OK]

Hint: Initialize serializer with key, then dumps(data) for token [OK]

Common Mistakes:

• Calling dumps as a static method
• Passing secret key to dumps instead of constructor
• Using loads instead of dumps to create token

3. Given this Flask code snippet, what will be printed if the token is valid and not expired?

from itsdangerous import URLSafeTimedSerializer
serializer = URLSafeTimedSerializer('secret')
token = serializer.dumps('[e-mail]')

try:
    email = serializer.loads(token, max_age=3600)
    print(email)
except Exception:
    print('Invalid or expired token')

medium

A. None

B. [e-mail]

C. secret

D. Invalid or expired token

Solution

1. Step 1: Understand what serializer.dumps and loads do

   dumps creates a token from the email string; loads decodes it back if valid and within max_age.

2. Step 2: Analyze the try-except block

   If the token is valid and not expired, loads returns the original email, which is printed.

3. Final Answer:

   [e-mail] -> Option B

4. Quick Check:

   Valid token returns original email [OK]

Hint: Valid loads returns original data, else error [OK]

Common Mistakes:

• Assuming loads returns the secret key
• Confusing dumps and loads output
• Ignoring max_age expiration

4. Identify the error in this Flask password reset token verification code:

from itsdangerous import URLSafeTimedSerializer
serializer = URLSafeTimedSerializer('secret')
token = serializer.dumps('[e-mail]')

email = serializer.loads(token, max_age=3600)
print(email)

medium

A. Missing try-except block to handle expired or invalid tokens

B. Incorrect secret key used in serializer

C. Using dumps instead of loads to decode token

D. max_age parameter is not supported in loads

Solution

1. Step 1: Review the code for error handling

   The code calls loads without try-except, so expired or invalid tokens cause exceptions.

2. Step 2: Identify the missing safety measure

   Proper pattern uses try-except to catch exceptions and handle errors gracefully.

3. Final Answer:

   Missing try-except block to handle expired or invalid tokens -> Option A

4. Quick Check:

   Always catch exceptions when verifying tokens [OK]

Hint: Always wrap loads in try-except to catch errors [OK]

Common Mistakes:

• Not handling exceptions on token verification
• Confusing dumps and loads usage
• Assuming max_age is unsupported

5. You want to implement a password reset feature in Flask that sends a reset link with a token valid for 30 minutes. Which approach correctly combines token creation, expiration, and email sending?

hard

A. Store user password in token, send email with token, verify token by comparing passwords

B. Generate token with random string, send email with token, verify token by checking string length

C. Create a URLSafeTimedSerializer with secret key, generate token with dumps(user_email), send email with link containing token, verify token with loads(token, max_age=1800)

D. Create token with dumps(user_email), send email without token, verify token with loads(token, max_age=3600)

Solution

1. Step 1: Understand token creation and expiration

   Use URLSafeTimedSerializer with secret key to create a token from user email; set max_age to 1800 seconds (30 minutes) when verifying.

2. Step 2: Combine with email sending and verification

   Send the token in the reset link via email; verify token on reset page using loads with max_age to ensure expiration.

3. Final Answer:

   Create a URLSafeTimedSerializer with secret key, generate token with dumps(user_email), send email with link containing token, verify token with loads(token, max_age=1800) -> Option C

4. Quick Check:

   Serializer + dumps + max_age + email link = secure reset [OK]

Hint: Use serializer dumps and loads with max_age for timed tokens [OK]

Common Mistakes:

• Not setting max_age for token expiration
• Sending token without including it in email link
• Storing passwords in tokens