0Pricing
AI Powered SaaS: Stripe + Auth + Billing + Deploy · 课时

密码重置与电子邮件验证

使用一次性令牌、过期机制和事务性电子邮件，构建安全的账户恢复与电子邮件验证流程，让用户能够安全地恢复访问权限。

密码重置与电子邮件验证 是 CoddyKit 上的免费 AI Powered SaaS: Stripe + Auth + Billing + Deploy 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 AI Powered SaaS: Stripe + Auth + Billing + Deploy 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 AI Powered SaaS: Stripe + Auth + Billing + Deploy 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Why Reset & Verify?

Users forget passwords and mistype emails. A safe password reset flow lets them recover without support, and email verification confirms the address really belongs to them, cutting spam and fake accounts.

The Token Strategy

Both flows rely on a one-time token: a random, unguessable string emailed to the user. Possessing it proves control of the inbox.

import crypto from 'crypto';
const token = crypto.randomBytes(32).toString('hex');

Storing the Token Hashed

Never store the raw token. Hash it before saving so a database leak cannot be used to reset accounts. Compare hashes when the user returns.

const hash = crypto.createHash('sha256').update(token).digest('hex');
await prisma.resetToken.create({
  data: { userId, hash, expiresAt }
});

Adding Expiry

Tokens must expire — usually 15 to 60 minutes. Store an expiresAt timestamp and reject tokens past it.

const expiresAt = new Date(Date.now() + 30 * 60 * 1000);

Requesting a Reset

The user submits their email. Generate a token, save its hash, and email a link containing the raw token. Always respond the same way to avoid leaking which emails exist.

const link = process.env.APP_URL + '/reset?token=' + token;
await sendEmail(email, 'Reset your password', link);

Sending Transactional Email

Use a provider like Resend or SendGrid for reliable delivery. Keep the message short with a clear single action.

import { Resend } from 'resend';
const resend = new Resend(process.env.RESEND_API_KEY);
await resend.emails.send({ to, subject, html });

Verifying the Token

When the user opens the link, hash the incoming token, look it up, and check it is unused and unexpired.

const hash = crypto.createHash('sha256').update(token).digest('hex');
const record = await prisma.resetToken.findFirst({
  where: { hash, expiresAt: { gt: new Date() }, usedAt: null }
});

Updating the Password

If valid, hash the new password and save it, then mark the token used so it cannot be replayed.

const pw = await bcrypt.hash(newPassword, 12);
await prisma.user.update({ where: { id: record.userId }, data: { password: pw } });
await prisma.resetToken.update({ where: { id: record.id }, data: { usedAt: new Date() } });

Email Verification Flow

Verification works the same way: on signup, email a token. When clicked, set emailVerified on the user and invalidate the token.

await prisma.user.update({
  where: { id }, data: { emailVerified: new Date() }
});

Preventing Abuse

Protect these endpoints:

  • Rate limit reset requests
  • Give identical responses for known and unknown emails
  • Allow only one active token per user

Best Practices

Build recovery securely:

  • Use random, hashed tokens with expiry
  • Send via a transactional email provider
  • Mark tokens used after one use
  • Rate limit and avoid email enumeration

Quick Check

Test your reset-flow knowledge.

Recap

You built account recovery:

  • Generate random tokens, store them hashed with expiry
  • Email links via a transactional provider
  • Verify, then update the password and mark the token used
  • Reuse the pattern for email verification and guard against abuse

Users can now safely recover and verify accounts.

常见问题解答

「密码重置与电子邮件验证」课时是免费的吗？

是的 — 「密码重置与电子邮件验证」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 AI Powered SaaS: Stripe + Auth + Billing + Deploy 课程的其余内容，请升级到 CoddyKit PRO。 AI Powered SaaS: Stripe + Auth + Billing + Deploy 课程共包含 4 节课。

「密码重置与电子邮件验证」这节课中我会学到什么？

使用一次性令牌、过期机制和事务性电子邮件，构建安全的账户恢复与电子邮件验证流程，让用户能够安全地恢复访问权限。 你通过在浏览器中直接运行的动手代码来练习 AI Powered SaaS: Stripe + Auth + Billing + Deploy，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 AI Powered SaaS: Stripe + Auth + Billing + Deploy 需要有经验吗？

无需任何先前经验。CoddyKit 上的 AI Powered SaaS: Stripe + Auth + Billing + Deploy 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。

「密码重置与电子邮件验证」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 AI Powered SaaS: Stripe + Auth + Billing + Deploy 课中编写并运行代码吗？

能。每节 AI Powered SaaS: Stripe + Auth + Billing + Deploy 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

  1. 用户注册与哈希处理
  2. 登录与 JWT 生成
  3. 受保护路由与中间件
  4. 密码重置与电子邮件验证
← 返回 AI Powered SaaS: Stripe + Auth + Billing + Deploy