Implement Forget password option with OTP verification

[Sibsankar-de]

Implementation of Password option

Describe the solution you'd like
A user can reset their password using a password reset link or OTP.

• User will create a password reset request
• A OTP email will be send.
• User can reset their password via that email.

Suggested Changes

• Implement a email service (nodemailer).
• Create controllers to request for otp.
• Controller to reset password by verifying the otp.

Implementation

• Update Signup and login UI
• Implement Backend routes and controllers.
• Integrate with UI.

[Sibsankar-de]

@Sibsankar-de Assign this issue to me I want to work on it.

[HarshYadav152]

@Sibsankar-de What approach you used for OTP verification ?

[Sibsankar-de]

Password Reset Using OTP – Flow

1. User clicks "Forgot Password" and enters registered email/username.

2. System validates request and generates a secure OTP.

3. OTP is hashed and stored in the OTP table with:

   • user reference
   • expiry time (5–10 mins)
   • used flag
   • timestamps

4. OTP is sent to the user's registered email.

5. User enters the OTP for verification.

6. System verifies:

   • OTP matches (hashed comparison)
   • OTP is not expired
   • OTP is not already used
   • Attempts are within limit

7. If valid:

   • Mark OTP as used
   • Generate short-lived reset token
   • Redirect user to reset password page

8. User sets a new password (with validation rules).

9. System updates password (securely hashed) and invalidates:

   • All active sessions
   • Remaining reset tokens

10. Send confirmation email after successful password reset.

[HarshYadav152]

@Sibsankar-de How to send OTPs to user's email.

[Sibsankar-de]

@HarshYadav152 We can use nodemailer to send emails. You will be just need to setup SMTP user and SMTP pass in environment.

[HarshYadav152]

@Sibsankar-de Alright go ahead with this.
But don't remember to add proper DKIM tags and unsubscribe fallback.
As these will increase chances of email not get into spam.