Password reset in Laravel - Step-by-Step Execution

Concept Flow - Password reset

User clicks 'Forgot Password'

↓

Show password reset request form

↓

User submits email

↓

Validate email exists

Yes↓

Generate reset token

↓

Send reset email with token link

↓

User clicks link in email

↓

Show reset password form

↓

User submits new password

↓

Validate token and password

Yes↓

Update user password

↓

Show success message

↓

END

This flow shows how Laravel handles password reset from user request to password update.

Execution Sample

Laravel

use IlluminateHttpRequest;
use IlluminateSupportFacadesPassword;

Route::post('/forgot-password', function (Request $request) {
    $request->validate(['email' => 'required|email']);
    $status = Password::sendResetLink($request->only('email'));
    return $status === Password::RESET_LINK_SENT
        ? back()->with(['status' => __($status)])
        : back()->withErrors(['email' => __($status)]);
});

This code handles the password reset email request by validating and sending the reset link.

Execution Table

Step	Action	Input	Validation Result	Outcome
1	User submits email	[e-mail]	Valid email format	Proceed to send reset link
2	Check email exists in DB	[e-mail]	Email found	Generate reset token
3	Send reset email	Token generated	Email sent successfully	Show success message
4	User clicks reset link	Token in URL	Token valid and not expired	Show reset password form
5	User submits new password	New password input	Password meets rules	Update password in DB
6	Confirm password update	Password updated	Success	Show password reset success page
7	End	-	-	Process complete

💡 Process ends after password is successfully updated and user is notified.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	Final
email	null	[e-mail]	[e-mail]	[e-mail]	[e-mail]
token	null	generated_token_123	generated_token_123	generated_token_123	null
password	null	null	null	new_secure_password	new_secure_password
status	null	RESET_LINK_SENT	RESET_LINK_SENT	PASSWORD_RESET	PASSWORD_RESET

Key Moments - 3 Insights

Why does the process check if the email exists before sending the reset link?

To avoid sending reset links to emails not registered, ensuring security and avoiding confusion. See execution_table step 2 where email validation happens.

What happens if the reset token is expired or invalid when the user clicks the link?

Laravel will reject the token and not show the reset form, preventing unauthorized password changes. This is implied in execution_table step 4.

Why is the token variable null at the end in variable_tracker?

After password reset, the token is invalidated or deleted for security, so it is null at the final step.

Visual Quiz - 3 Questions

Look at the execution_table, what is the validation result at step 2?

A Email found

B Email not found

C Invalid email format

D Token expired

💡 Hint

Check the 'Validation Result' column in execution_table row for step 2.

At which step does the user submit the new password?

A Step 1

B Step 3

C Step 5

D Step 6

💡 Hint

Look at the 'Action' column in execution_table to find when new password is submitted.

If the email format is invalid, what would change in the execution_table?

A Step 2 would fail with 'Email not found'

B Step 1 validation result would be 'Invalid email format' and process stops

C Token would not be generated at step 3

D Password update would fail at step 5

💡 Hint

Refer to step 1 validation result and how invalid input affects flow.

Concept Snapshot

Password reset in Laravel:
- User requests reset by submitting email
- System validates email and sends reset link with token
- User clicks link, token validated
- User submits new password
- Password updated and token invalidated
- Uses built-in Password facade and routes
- Secure and user-friendly flow

Full Transcript

This visual execution trace shows how Laravel handles password reset. The user starts by clicking 'Forgot Password' and submitting their email. The system validates the email format and checks if it exists in the database. If valid, Laravel generates a reset token and sends an email with a reset link. When the user clicks the link, Laravel validates the token and shows a form to enter a new password. After submitting, the password is validated and updated in the database. The token is then invalidated to prevent reuse. The user sees a success message, completing the process. Variables like email, token, password, and status change through these steps, ensuring security and smooth user experience.

Practice

1. What is the main purpose of Laravel's password reset feature?

easy

A. To update the user's profile picture

B. To change the user's email address

C. To delete the user's account permanently

D. To allow users to safely recover access to their accounts

Solution

1. Step 1: Understand password reset functionality

   Password reset is designed to help users regain access if they forget their password.

2. Step 2: Identify the correct purpose in options

   Only To allow users to safely recover access to their accounts describes recovering account access safely, which matches password reset.

3. Final Answer:

   To allow users to safely recover access to their accounts -> Option D

4. Quick Check:

   Password reset = recover access [OK]

Hint: Password reset helps regain account access safely [OK]

Common Mistakes:

• Confusing password reset with profile updates
• Thinking it deletes the account
• Assuming it changes email address

2. Which Laravel command publishes the password reset email template for customization?

easy

A. php artisan vendor:publish --tag=laravel-password-reset

B. php artisan make:auth

C. php artisan vendor:publish --tag=laravel-mail

D. php artisan migrate

Solution

1. Step 1: Identify command to publish email templates

   Laravel uses vendor:publish with specific tags to publish resources like email templates.

2. Step 2: Match the correct tag for mail templates

   The tag 'laravel-mail' is used to publish mail templates including password reset emails.

3. Final Answer:

   php artisan vendor:publish --tag=laravel-mail -> Option C

4. Quick Check:

   Publish mail templates = vendor:publish --tag=laravel-mail [OK]

Hint: Use vendor:publish with mail tag to customize emails [OK]

Common Mistakes:

• Using make:auth which is deprecated
• Wrong tag like laravel-password-reset
• Running migrate instead of publishing

3. Given this Laravel password reset route snippet, what HTTP method should the form use to submit the reset token and new password?

<form action="{{ route('password.update') }}" method="?">
  @csrf
  <input type="hidden" name="token" value="{{ $token }}">
  <input type="email" name="email" required>
  <input type="password" name="password" required>
  <input type="password" name="password_confirmation" required>
  <button type="submit">Reset Password</button>
</form>

medium

A. GET

B. POST

C. PUT

D. DELETE

Solution

1. Step 1: Understand password reset form submission

   The form sends sensitive data (password, token) to update the password securely.

2. Step 2: Identify correct HTTP method for secure data submission

   POST method is used to send data to the server for processing, especially for updates like password reset.

3. Final Answer:

   POST -> Option B

4. Quick Check:

   Form sending data securely = POST [OK]

Hint: Use POST to send password reset data securely [OK]

Common Mistakes:

• Using GET which exposes data in URL
• Using PUT or DELETE which are not default form methods
• Omitting CSRF token with POST

4. You wrote this code to send a password reset link but users report no emails received:

use Illuminate\Support\Facades\Password;

Password::sendResetLink(['email' => $request->email]);

What is the likely mistake?

medium

A. Missing the return statement to check success

B. Using the wrong facade, should use Mail instead

C. Not validating the email before sending reset link

D. Not calling the notify() method on the user model

Solution

1. Step 1: Understand Password::sendResetLink usage

   This method returns a status indicating if the email was sent successfully or failed.

2. Step 2: Identify missing check for success

   Without capturing and checking the return value, you won't know if sending failed silently.

3. Final Answer:

   Missing the return statement to check success -> Option A

4. Quick Check:

   Check sendResetLink return to confirm email sent [OK]

Hint: Always check sendResetLink return status for success [OK]

Common Mistakes:

• Assuming Mail facade is needed directly
• Skipping email validation before sending
• Trying to call notify() manually for reset link

5. You want to customize Laravel's password reset to expire tokens after 30 minutes instead of the default. Which file and setting should you modify?

hard

A. config/auth.php, 'passwords.users.expire' => 30

B. config/mail.php, 'reset_token_expiry' => 30

C. routes/web.php, add middleware for token expiry

D. app/Http/Controllers/ResetPasswordController.php, set token expiry property

Solution

1. Step 1: Identify where password reset token expiry is configured

   Laravel stores password reset settings in config/auth.php under 'passwords' array.

2. Step 2: Locate the 'expire' key for users password broker

   The 'expire' key defines token validity in minutes; changing it to 30 sets expiry to 30 minutes.

3. Final Answer:

   config/auth.php, 'passwords.users.expire' => 30 -> Option A

4. Quick Check:

   Token expiry set in config/auth.php passwords.users.expire [OK]

Hint: Change expire in config/auth.php under passwords.users [OK]

Common Mistakes:

• Trying to set expiry in mail config
• Adding middleware instead of config change
• Modifying controller instead of config