Password reset in Laravel - Mini Project: Build & Apply

Password reset

📖 Scenario: You are building a simple Laravel app that allows users to reset their password if they forget it. This is a common feature in many websites to help users regain access securely.

🎯 Goal: Create the basic password reset flow in Laravel by setting up the necessary routes, controller methods, and views to send a reset link and update the password.

📋 What You'll Learn

Create a route group for password reset with named routes

Create a controller named PasswordResetController with methods for showing the reset request form, sending the reset email, showing the reset form, and updating the password

Use Laravel's built-in password broker to send reset links and reset passwords

Create simple Blade views for the reset request form and the password reset form

💡 Why This Matters

🌍 Real World

Password reset is a critical feature in almost all web applications to help users regain access when they forget their password.

💼 Career

Understanding how to implement password reset flows using Laravel's built-in features is a common task for backend and full-stack developers working with Laravel.

1

Set up password reset routes

In the routes/web.php file, create a route group with prefix password and name prefix password.. Inside it, add these routes: a GET route /reset named request that uses PasswordResetController@showRequestForm, a POST route /email named email that uses PasswordResetController@sendResetLinkEmail, a GET route /reset/{token} named reset that uses PasswordResetController@showResetForm, and a POST route /reset named update that uses PasswordResetController@reset.

Laravel

// Your code here

Hint

Use Laravel's Route facade to create a group with prefix password and name prefix password.. Then add the four routes with the exact methods and names.

2

Create PasswordResetController with request form methods

Create a controller named PasswordResetController in app/Http/Controllers. Add a public method showRequestForm that returns the view auth.passwords.email. Add a public method sendResetLinkEmail that accepts a Request $request, validates the email field as required and email format, and uses Password::sendResetLink to send the reset link. Return back with status or error message.

Laravel

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Password;

class PasswordResetController extends Controller
{
    // Your code here
}

Hint

Define the controller class with the two methods. Use view('auth.passwords.email') to show the form. Use $request->validate and Password::sendResetLink to send the email.

3

Add reset form methods in PasswordResetController

In PasswordResetController, add a public method showResetForm that accepts $token and returns the view auth.passwords.reset passing the token and email from the request. Add a public method reset that accepts Request $request, validates token, email, password (required, confirmed, min 8), and uses Password::reset to update the password. Return redirect to login with success or back with errors.

Laravel

validate(['email' => 'required|email']);

        $status = Password::sendResetLink(
            $request->only('email')
        );

        return $status === Password::RESET_LINK_SENT
                    ? back()->with(['status' => __($status)])
                    : back()->withErrors(['email' => __($status)]);
    }

    // Add showResetForm and reset methods below
}

Hint

Add the two methods to show the reset form and handle the reset. Use view('auth.passwords.reset') with token and email. Validate inputs and use Password::reset with a callback to update the password.

4

Create Blade views for password reset forms

Create two Blade view files: resources/views/auth/passwords/email.blade.php and resources/views/auth/passwords/reset.blade.php. In email.blade.php, create a form with method POST to route password.email containing an email input named email and a submit button labeled 'Send Password Reset Link'. In reset.blade.php, create a form with method POST to route password.update containing hidden input token, email input email, password input password, password confirmation input password_confirmation, and a submit button labeled 'Reset Password'. Include CSRF tokens in both forms.

Laravel

Hint

Create two Blade files with forms for requesting a reset link and for resetting the password. Use POST method, include CSRF tokens, and the exact input names and labels.

Practice

1. What is the main purpose of Laravel's password reset feature?

easy

A. To update the user's profile picture

B. To change the user's email address

C. To delete the user's account permanently

D. To allow users to safely recover access to their accounts

Solution

1. Step 1: Understand password reset functionality

   Password reset is designed to help users regain access if they forget their password.

2. Step 2: Identify the correct purpose in options

   Only To allow users to safely recover access to their accounts describes recovering account access safely, which matches password reset.

3. Final Answer:

   To allow users to safely recover access to their accounts -> Option D

4. Quick Check:

   Password reset = recover access [OK]

Hint: Password reset helps regain account access safely [OK]

Common Mistakes:

• Confusing password reset with profile updates
• Thinking it deletes the account
• Assuming it changes email address

2. Which Laravel command publishes the password reset email template for customization?

easy

A. php artisan vendor:publish --tag=laravel-password-reset

B. php artisan make:auth

C. php artisan vendor:publish --tag=laravel-mail

D. php artisan migrate

Solution

1. Step 1: Identify command to publish email templates

   Laravel uses vendor:publish with specific tags to publish resources like email templates.

2. Step 2: Match the correct tag for mail templates

   The tag 'laravel-mail' is used to publish mail templates including password reset emails.

3. Final Answer:

   php artisan vendor:publish --tag=laravel-mail -> Option C

4. Quick Check:

   Publish mail templates = vendor:publish --tag=laravel-mail [OK]

Hint: Use vendor:publish with mail tag to customize emails [OK]

Common Mistakes:

• Using make:auth which is deprecated
• Wrong tag like laravel-password-reset
• Running migrate instead of publishing

3. Given this Laravel password reset route snippet, what HTTP method should the form use to submit the reset token and new password?

<form action="{{ route('password.update') }}" method="?">
  @csrf
  <input type="hidden" name="token" value="{{ $token }}">
  <input type="email" name="email" required>
  <input type="password" name="password" required>
  <input type="password" name="password_confirmation" required>
  <button type="submit">Reset Password</button>
</form>

medium

A. GET

B. POST

C. PUT

D. DELETE

Solution

1. Step 1: Understand password reset form submission

   The form sends sensitive data (password, token) to update the password securely.

2. Step 2: Identify correct HTTP method for secure data submission

   POST method is used to send data to the server for processing, especially for updates like password reset.

3. Final Answer:

   POST -> Option B

4. Quick Check:

   Form sending data securely = POST [OK]

Hint: Use POST to send password reset data securely [OK]

Common Mistakes:

• Using GET which exposes data in URL
• Using PUT or DELETE which are not default form methods
• Omitting CSRF token with POST

4. You wrote this code to send a password reset link but users report no emails received:

use Illuminate\Support\Facades\Password;

Password::sendResetLink(['email' => $request->email]);

What is the likely mistake?

medium

A. Missing the return statement to check success

B. Using the wrong facade, should use Mail instead

C. Not validating the email before sending reset link

D. Not calling the notify() method on the user model

Solution

1. Step 1: Understand Password::sendResetLink usage

   This method returns a status indicating if the email was sent successfully or failed.

2. Step 2: Identify missing check for success

   Without capturing and checking the return value, you won't know if sending failed silently.

3. Final Answer:

   Missing the return statement to check success -> Option A

4. Quick Check:

   Check sendResetLink return to confirm email sent [OK]

Hint: Always check sendResetLink return status for success [OK]

Common Mistakes:

• Assuming Mail facade is needed directly
• Skipping email validation before sending
• Trying to call notify() manually for reset link

5. You want to customize Laravel's password reset to expire tokens after 30 minutes instead of the default. Which file and setting should you modify?

hard

A. config/auth.php, 'passwords.users.expire' => 30

B. config/mail.php, 'reset_token_expiry' => 30

C. routes/web.php, add middleware for token expiry

D. app/Http/Controllers/ResetPasswordController.php, set token expiry property

Solution

1. Step 1: Identify where password reset token expiry is configured

   Laravel stores password reset settings in config/auth.php under 'passwords' array.

2. Step 2: Locate the 'expire' key for users password broker

   The 'expire' key defines token validity in minutes; changing it to 30 sets expiry to 30 minutes.

3. Final Answer:

   config/auth.php, 'passwords.users.expire' => 30 -> Option A

4. Quick Check:

   Token expiry set in config/auth.php passwords.users.expire [OK]

Hint: Change expire in config/auth.php under passwords.users [OK]

Common Mistakes:

• Trying to set expiry in mail config
• Adding middleware instead of config change
• Modifying controller instead of config