Password reset flows in No-Code - Step-by-Step Execution

Concept Flow - Password reset flows

User clicks 'Forgot Password'

↓

User enters email or username

↓

System sends reset link or code

↓

User receives email or SMS

↓

User clicks link or enters code

↓

User sets new password

↓

System updates password and confirms

↓

End

The flow starts when a user requests a password reset, then the system sends a reset link or code, the user verifies it, sets a new password, and the system confirms the update.

Execution Sample

No-Code

1. User clicks 'Forgot Password'
2. User enters email
3. System sends reset email
4. User clicks link
5. User sets new password
6. System confirms reset

This sequence shows the main steps a user and system take during a password reset.

Analysis Table

Step	Action	Input/Condition	System Response	User Output
1	User clicks 'Forgot Password'	N/A	Show email input form	See email input form
2	User enters email	Valid email entered	Send reset link to email	Wait for email
3	User receives email	Email with reset link received	N/A	Click reset link
4	User clicks reset link	Link is valid and not expired	Show new password form	See new password form
5	User enters new password	Password meets criteria	Update password in system	See confirmation message
6	User sees confirmation	Password updated	Allow login with new password	Password reset complete
7	If link expired or invalid	Link invalid or expired	Show error message	Prompt to retry password reset

💡 Process ends when password is successfully reset or user is informed of an error.

State Tracker

Variable	Start	After Step 2	After Step 4	After Step 5	Final
User Email	None	[e-mail]	[e-mail]	[e-mail]	[e-mail]
Reset Link Status	None	Sent	Clicked and Valid	Used	Expired or Used
New Password	None	None	None	User input password	Stored securely
Process State	Start	Waiting for email click	Waiting for new password	Updating password	Completed or Error

Key Insights - 3 Insights

Why does the system send a reset link instead of the password itself?

For security, the system never sends the actual password. Instead, it sends a temporary reset link to verify the user's identity before allowing a new password to be set, as shown in execution_table step 2 and 3.

What happens if the user clicks an expired reset link?

The system detects the link is invalid or expired and shows an error message prompting the user to retry, as seen in execution_table step 7.

Why must the new password meet certain criteria?

To keep accounts secure, the system requires the new password to meet rules like length or complexity before updating, as indicated in execution_table step 5.

Visual Quiz - 3 Questions

Look at the execution table, what does the system do after the user enters their email?

A Immediately resets the password

B Shows an error message

C Sends a reset link to the email

D Logs the user in

💡 Hint

Check step 2 in the execution_table where the system response is described.

At which step does the user set their new password?

A Step 5

B Step 4

C Step 3

D Step 6

💡 Hint

Look at the 'User Output' column in the execution_table for when the new password form is shown and filled.

If the reset link is expired, what is the system's response?

A Send a new reset link automatically

B Show an error message prompting retry

C Allow password reset anyway

D Ignore the click

💡 Hint

Refer to step 7 in the execution_table describing the invalid link scenario.

Concept Snapshot

Password reset flows:
1. User requests reset by entering email.
2. System sends a secure reset link or code.
3. User verifies via link or code.
4. User sets a new password meeting criteria.
5. System updates password and confirms.
Always protects user security by never sending passwords directly.

Full Transcript

Password reset flows start when a user clicks 'Forgot Password' and enters their email. The system sends a reset link to that email. The user receives the email and clicks the link, which must be valid and not expired. Then the user sets a new password that meets security rules. The system updates the password and confirms the reset. If the link is invalid or expired, the system shows an error and asks the user to retry. This flow ensures security by verifying identity before allowing password changes.

Practice

1. What is the main purpose of a password reset flow in an application?

easy

A. To change the username of the user

B. To delete the user account permanently

C. To help users regain access to their accounts safely

D. To update the user's email address

Solution

1. Step 1: Understand the purpose of password reset

   Password reset flows are designed to help users who forgot their password regain access to their accounts.

2. Step 2: Identify the correct purpose among options

   Only To help users regain access to their accounts safely describes this purpose correctly, while others describe unrelated actions.

3. Final Answer:

   To help users regain access to their accounts safely -> Option C

4. Quick Check:

   Password reset purpose = regain access [OK]

Hint: Password reset helps regain access, not change username [OK]

Common Mistakes:

• Confusing password reset with username change
• Thinking password reset deletes account
• Assuming password reset updates email

2. Which of the following is a common step in a password reset flow?

easy

A. Changing the user's username to 'reset_user'

B. Automatically changing the password without user input

C. Deleting the user account after reset request

D. Sending a reset link or code to the user's email

Solution

1. Step 1: Identify typical password reset steps

   Commonly, a reset link or code is sent to the user's registered email to verify identity.

2. Step 2: Compare options to standard practice

   Only Sending a reset link or code to the user's email matches this standard step; others describe incorrect or harmful actions.

3. Final Answer:

   Sending a reset link or code to the user's email -> Option D

4. Quick Check:

   Reset step = send link/code [OK]

Hint: Reset flows send links or codes, not auto-change passwords [OK]

Common Mistakes:

• Thinking password resets happen without user confirmation
• Believing accounts get deleted after reset
• Confusing username change with password reset

3. In a password reset flow, why is it important that the reset link expires after some time?

medium

A. To prevent unauthorized use if the link is intercepted

B. To allow users to reset password multiple times quickly

C. To make the reset process slower and more secure

D. To automatically change the password after expiration

Solution

1. Step 1: Understand security risks of reset links

   If a reset link never expires, someone who gets it later could misuse it to access the account.

2. Step 2: Identify why expiration helps security

   Expiration limits the time window for misuse, protecting the user's account.

3. Final Answer:

   To prevent unauthorized use if the link is intercepted -> Option A

4. Quick Check:

   Expiration = prevent misuse [OK]

Hint: Expiration stops old links from being misused [OK]

Common Mistakes:

• Thinking expiration slows down the process intentionally
• Believing expiration allows multiple resets quickly
• Assuming password changes automatically after expiration

4. A password reset flow sends a reset code to the user, but the code never expires. What is the main problem with this?

medium

A. The reset code can be reused by attackers anytime

B. Users might forget the code quickly

C. The system will send multiple codes automatically

D. The user cannot reset the password without expiration

Solution

1. Step 1: Analyze the effect of no expiration on reset codes

   If reset codes never expire, anyone who obtains the code can use it anytime to reset the password.

2. Step 2: Identify the security risk

   This creates a security risk because attackers can reuse old codes to access accounts.

3. Final Answer:

   The reset code can be reused by attackers anytime -> Option A

4. Quick Check:

   No expiration = code reuse risk [OK]

Hint: No expiration means codes can be reused by attackers [OK]

Common Mistakes:

• Thinking users forget codes quickly is the main issue
• Assuming system sends codes automatically without request
• Believing expiration prevents password reset entirely

5. You want to design a password reset flow that prevents attackers from guessing reset codes easily. Which approach is best?

hard

A. Use short numeric codes that expire quickly

B. Use long random alphanumeric codes with expiration

C. Send the reset code via public chat for transparency

D. Allow unlimited attempts to enter the reset code

Solution

1. Step 1: Consider code complexity and expiration

   Long random alphanumeric codes are harder to guess than short numeric ones, and expiration limits time for attacks.

2. Step 2: Evaluate options for security

   The approach of using long random alphanumeric codes with expiration combines strong code complexity with time-limited validity, providing optimal security. Other approaches--short numeric codes, unlimited entry attempts, and public code sharing--are vulnerable to guessing, brute-force attacks, or interception.

3. Final Answer:

   Use long random alphanumeric codes with expiration -> Option B

4. Quick Check:

   Strong code + expiration = best security [OK]

Hint: Long random codes with expiration improve security best [OK]

Common Mistakes:

• Choosing short codes that are easy to guess
• Sharing codes publicly reduces security
• Allowing unlimited attempts invites brute force