The current code password reset uses the user's token, which is also used for authorization. this gives complete access to anyone that can access that email.
Even the user itself can use the token to verify without knowing the password.
this is considered a potential risk and should be solved.
Solution
I use Django's built-in system for password reset. in this method, Django creates a cryptographic hashed token using the HMAC algorithm that can only be used once to reset a password. along with the user id as a URL-safe encoded base64 value.
The current code password reset uses the user's token, which is also used for authorization. this gives complete access to anyone that can access that email.
Even the user itself can use the token to verify without knowing the password. this is considered a potential risk and should be solved.
Solution
I use Django's built-in system for password reset. in this method, Django creates a cryptographic hashed token using the HMAC algorithm that can only be used once to reset a password. along with the user id as a URL-safe encoded base64 value.