Generate secret code for password reset

Question

I'm doing a module which allow users to reset password. I noticed how most websites they provide a confirmation link which contain query string that has a unique hash.

My question is: How can I generate this unique hash each time the same user request forgot password? Should I store this hash in database and use it for verification later on? Will it be safe? Or should I create some sort of algorithm which generate one-time password? How can I generate a OTP?

Answer 1

Yes, you should

1. Generate a random reset token. See e.g. this answer.
2. Store it in the database (possibly with an expiry time)
3. Send e-mail to the user with the reset token.
4. User visits the reset password page with the reset token in the query string.
5. Check the database to see the user associated with the reset token and if the expiry time hasn't passed.
6. If everything checks out, allow the user to reset the password and delete the reset token from the database.

There seems to be a lot a confusion about the generation of the reset token (or whatever you want to call it). Please read the answer I've linked to and don't reinvent the wheel with hashes and weak seeds.