Password reset in Laravel - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens after submitting a valid password reset request in Laravel?

In Laravel's built-in password reset system, when a user submits their email to request a password reset link, what is the expected behavior?

A Laravel sends an email with a reset link and shows a success message on the same page.

B Laravel redirects the user to the login page without sending any email.

C Laravel immediately resets the password to a default value and logs the user in.

D Laravel deletes the user account and shows an error message.

💡 Hint

Think about what a password reset link is for.

Laravel sends an email containing a secure reset link and shows a confirmation message so the user knows to check their email.

📝 Syntax

intermediate

Which code snippet correctly defines the password reset route in Laravel?

Laravel uses routes to handle password reset requests. Which of the following route definitions correctly sets up the password reset POST route?

A Route::post('/reset-password', 'PasswordResetController@reset')->name('password.update');

B Route::put('/reset-password', [PasswordResetController::class, 'reset'])->name('password.update');

C Route::get('/reset-password', [PasswordResetController::class, 'reset'])->name('password.update');

D Route::post('/reset-password', [PasswordResetController::class, 'reset'])->name('password.update');

💡 Hint

Consider the HTTP method used for submitting form data securely.

The password reset form submits data via POST, so the route must use Route::post with the correct controller and method.

🔧 Debug

advanced

Why does the password reset token expire immediately after generation?

Consider this Laravel password reset token generation snippet:

$token = Password::createToken($user);

But when trying to use the token, it is always expired. What is the most likely cause?

A The token is generated with the wrong user ID.

B The token is generated but never saved to the database.

C The token expiration time is set to zero or a past time in the config/auth.php file.

D The user model does not implement the MustVerifyEmail interface.

💡 Hint

Check the configuration that controls token lifetime.

Laravel uses a config value to set how long reset tokens are valid. If set to zero or negative, tokens expire immediately.

❓ state_output

advanced

What is the value of $status after a successful password reset?

Given this Laravel code snippet:

$status = Password::reset($credentials, function ($user, $password) {
    $user->forceFill(['password' => Hash::make($password)])->save();
    $user->setRememberToken(Str::random(60));
});

What will be the value of $status if the reset succeeds?

A true

B Password::PASSWORD_RESET

C null

D Password::RESET_SUCCESS

💡 Hint

Look for constants defined in the Password facade.

Laravel returns the constant Password::PASSWORD_RESET on success, not a boolean or null.

🧠 Conceptual

expert

Why should password reset tokens be single-use and time-limited?

In Laravel's password reset system, tokens are designed to be used only once and expire after a short time. Why is this important?

A To prevent attackers from reusing stolen tokens and to limit the window for attacks.

B To reduce database storage by deleting tokens quickly.

C To force users to reset passwords frequently for better security.

D To allow multiple users to share the same reset link safely.

💡 Hint

Think about security risks of token reuse and long validity.

Single-use and expiration prevent attackers from using old or stolen tokens to reset passwords without permission.

Practice

1. What is the main purpose of Laravel's password reset feature?

easy

A. To update the user's profile picture

B. To change the user's email address

C. To delete the user's account permanently

D. To allow users to safely recover access to their accounts

Solution

1. Step 1: Understand password reset functionality

   Password reset is designed to help users regain access if they forget their password.

2. Step 2: Identify the correct purpose in options

   Only To allow users to safely recover access to their accounts describes recovering account access safely, which matches password reset.

3. Final Answer:

   To allow users to safely recover access to their accounts -> Option D

4. Quick Check:

   Password reset = recover access [OK]

Hint: Password reset helps regain account access safely [OK]

Common Mistakes:

• Confusing password reset with profile updates
• Thinking it deletes the account
• Assuming it changes email address

2. Which Laravel command publishes the password reset email template for customization?

easy

A. php artisan vendor:publish --tag=laravel-password-reset

B. php artisan make:auth

C. php artisan vendor:publish --tag=laravel-mail

D. php artisan migrate

Solution

1. Step 1: Identify command to publish email templates

   Laravel uses vendor:publish with specific tags to publish resources like email templates.

2. Step 2: Match the correct tag for mail templates

   The tag 'laravel-mail' is used to publish mail templates including password reset emails.

3. Final Answer:

   php artisan vendor:publish --tag=laravel-mail -> Option C

4. Quick Check:

   Publish mail templates = vendor:publish --tag=laravel-mail [OK]

Hint: Use vendor:publish with mail tag to customize emails [OK]

Common Mistakes:

• Using make:auth which is deprecated
• Wrong tag like laravel-password-reset
• Running migrate instead of publishing

3. Given this Laravel password reset route snippet, what HTTP method should the form use to submit the reset token and new password?

<form action="{{ route('password.update') }}" method="?">
  @csrf
  <input type="hidden" name="token" value="{{ $token }}">
  <input type="email" name="email" required>
  <input type="password" name="password" required>
  <input type="password" name="password_confirmation" required>
  <button type="submit">Reset Password</button>
</form>

medium

A. GET

B. POST

C. PUT

D. DELETE

Solution

1. Step 1: Understand password reset form submission

   The form sends sensitive data (password, token) to update the password securely.

2. Step 2: Identify correct HTTP method for secure data submission

   POST method is used to send data to the server for processing, especially for updates like password reset.

3. Final Answer:

   POST -> Option B

4. Quick Check:

   Form sending data securely = POST [OK]

Hint: Use POST to send password reset data securely [OK]

Common Mistakes:

• Using GET which exposes data in URL
• Using PUT or DELETE which are not default form methods
• Omitting CSRF token with POST

4. You wrote this code to send a password reset link but users report no emails received:

use Illuminate\Support\Facades\Password;

Password::sendResetLink(['email' => $request->email]);

What is the likely mistake?

medium

A. Missing the return statement to check success

B. Using the wrong facade, should use Mail instead

C. Not validating the email before sending reset link

D. Not calling the notify() method on the user model

Solution

1. Step 1: Understand Password::sendResetLink usage

   This method returns a status indicating if the email was sent successfully or failed.

2. Step 2: Identify missing check for success

   Without capturing and checking the return value, you won't know if sending failed silently.

3. Final Answer:

   Missing the return statement to check success -> Option A

4. Quick Check:

   Check sendResetLink return to confirm email sent [OK]

Hint: Always check sendResetLink return status for success [OK]

Common Mistakes:

• Assuming Mail facade is needed directly
• Skipping email validation before sending
• Trying to call notify() manually for reset link

5. You want to customize Laravel's password reset to expire tokens after 30 minutes instead of the default. Which file and setting should you modify?

hard

A. config/auth.php, 'passwords.users.expire' => 30

B. config/mail.php, 'reset_token_expiry' => 30

C. routes/web.php, add middleware for token expiry

D. app/Http/Controllers/ResetPasswordController.php, set token expiry property

Solution

1. Step 1: Identify where password reset token expiry is configured

   Laravel stores password reset settings in config/auth.php under 'passwords' array.

2. Step 2: Locate the 'expire' key for users password broker

   The 'expire' key defines token validity in minutes; changing it to 30 sets expiry to 30 minutes.

3. Final Answer:

   config/auth.php, 'passwords.users.expire' => 30 -> Option A

4. Quick Check:

   Token expiry set in config/auth.php passwords.users.expire [OK]

Hint: Change expire in config/auth.php under passwords.users [OK]

Common Mistakes:

• Trying to set expiry in mail config
• Adding middleware instead of config change
• Modifying controller instead of config