Password reset in Laravel - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens after submitting a valid password reset request in Laravel?

In Laravel's built-in password reset system, when a user submits their email to request a password reset link, what is the expected behavior?

A Laravel sends an email with a reset link and shows a success message on the same page.

B Laravel redirects the user to the login page without sending any email.

C Laravel immediately resets the password to a default value and logs the user in.

D Laravel deletes the user account and shows an error message.

💡 Hint

Think about what a password reset link is for.

Laravel sends an email containing a secure reset link and shows a confirmation message so the user knows to check their email.

📝 Syntax

intermediate

Which code snippet correctly defines the password reset route in Laravel?

Laravel uses routes to handle password reset requests. Which of the following route definitions correctly sets up the password reset POST route?

A Route::post('/reset-password', 'PasswordResetController@reset')->name('password.update');

B Route::put('/reset-password', [PasswordResetController::class, 'reset'])->name('password.update');

C Route::get('/reset-password', [PasswordResetController::class, 'reset'])->name('password.update');

D Route::post('/reset-password', [PasswordResetController::class, 'reset'])->name('password.update');

💡 Hint

Consider the HTTP method used for submitting form data securely.

The password reset form submits data via POST, so the route must use Route::post with the correct controller and method.

🔧 Debug

advanced

Why does the password reset token expire immediately after generation?

Consider this Laravel password reset token generation snippet:

$token = Password::createToken($user);

But when trying to use the token, it is always expired. What is the most likely cause?

A The token is generated with the wrong user ID.

B The token is generated but never saved to the database.

C The token expiration time is set to zero or a past time in the config/auth.php file.

D The user model does not implement the MustVerifyEmail interface.

💡 Hint

Check the configuration that controls token lifetime.

Laravel uses a config value to set how long reset tokens are valid. If set to zero or negative, tokens expire immediately.

❓ state_output

advanced

What is the value of $status after a successful password reset?

Given this Laravel code snippet:

$status = Password::reset($credentials, function ($user, $password) {
    $user->forceFill(['password' => Hash::make($password)])->save();
    $user->setRememberToken(Str::random(60));
});

What will be the value of $status if the reset succeeds?

A true

B Password::PASSWORD_RESET

C null

D Password::RESET_SUCCESS

💡 Hint

Look for constants defined in the Password facade.

Laravel returns the constant Password::PASSWORD_RESET on success, not a boolean or null.

🧠 Conceptual

expert

Why should password reset tokens be single-use and time-limited?

In Laravel's password reset system, tokens are designed to be used only once and expire after a short time. Why is this important?

A To prevent attackers from reusing stolen tokens and to limit the window for attacks.

B To reduce database storage by deleting tokens quickly.

C To force users to reset passwords frequently for better security.

D To allow multiple users to share the same reset link safely.

💡 Hint

Think about security risks of token reuse and long validity.

Single-use and expiration prevent attackers from using old or stolen tokens to reset passwords without permission.