We'll generally want to implement a "Forgot your password" feature that lets a user recover their account by email. This area has a plethora of potential vulnerabilities because the whole point is to let an unauthenticated user take over an account. We'll implement our password reset using some of the same techniques as our email confirmation.
We'll need a form to request a reset for a given account's email and a form to choose a new password once we've confirmed that the unauthenticated user has access to that email address. The code in this section assumes that our user model has an email and a password, where the password is a hybrid property as we previously created.
Caution Don't send password reset links to an unconfirmed email address! You want to be sure that you are sending this link to the right person.
We're going to need two forms. One is to request that a reset link be sent to a certain email and the other is to change the password once the email has been verified.
# ourapp/forms.py
from flask_wtf import Form
from wtforms import StringField, PasswordField
from wtforms.validators import DataRequired, Email
class EmailForm(Form):
email = TextField('Email', validators=[DataRequired(), Email()])
class PasswordForm(Form):
password = PasswordField('Email', validators=[DataRequired()])This code assumes that our password reset form just needs one field for
the password. Many apps require the user to enter their new password
twice to confirm that they haven't made a typo. To do this, we'd simply
add another PasswordField and add the EqualTo WTForms validator to
the main password field.
Note There a lot of interesting discussions in the User Experience (UX) community about the best way to handle this in sign-up forms. I personally like the thoughts of one Stack Exchange user (Roger Attrill) who said:
"We should not ask for password twice - we should ask for it once and make sure that the 'forgot password' system works seamlessly and flawlessly."
- Read more about this topic in the thread on the User Experience Stack Exchange.
- There are also some cool ideas for simplifying sign-up and sign-in forms in an article on Smashing Magazine article.
Now we'll implement the first view of our process, where a user can request that a password reset link be sent for a given email address.
# ourapp/views.py
from flask import redirect, url_for, render_template
from . import app
from .forms import EmailForm
from .models import User
from .util import send_email, ts
@app.route('/reset', methods=["GET", "POST"])
def reset():
form = EmailForm()
if form.validate_on_submit()
user = User.query.filter_by(email=form.email.data).first_or_404()
subject = "Password reset requested"
# Here we use the URLSafeTimedSerializer we created in `util` at the
# beginning of the chapter
token = ts.dumps(self.email, salt='recover-key')
recover_url = url_for(
'reset_with_token',
token=token,
_external=True)
html = render_template(
'email/recover.html',
recover_url=recover_url)
# Let's assume that send_email was defined in myapp/util.py
send_email(user.email, subject, html)
return redirect(url_for('index'))
return render_template('reset.html', form=form)When the form receives an email address, we grab the user with that email address, generate a reset token and send them a password reset URL. That URL routes them to a view that will validate the token and let them reset the password.
# ourapp/views.py
from flask import redirect, url_for, render_template
from . import app, db
from .forms import PasswordForm
from .models import User
from .util import ts
@app.route('/reset/<token>', methods=["GET", "POST"])
def reset_with_token(token):
try:
email = ts.loads(token, salt="recover-key", max_age=86400)
except:
abort(404)
form = PasswordForm()
if form.validate_on_submit():
user = User.query.filter_by(email=email).first_or_404()
user.password = form.password.data
db.session.add(user)
db.session.commit()
return redirect(url_for('signin'))
return render_template('reset_with_token.html', form=form, token=token)We're using the same token validation method as we did to confirm the user's email address. The view passes the token from the URL back into the template. Then the template uses the token to submit the form to the right URL. Let's have a look at what that template might look like.
{# ourapp/templates/reset_with_token.html #}
{% extends "layout.html" %}
{% block body %}
<form action="{{ url_for('reset_with_token', token=token) }}" method="POST">
{{ form.password.label }}: {{ form.password }}<br>
{{ form.csrf_token }}
<input type="submit" value="Change my password" />
</form>
{% endblock %}