11:49 p.m.
Good morning my friends, I think I finally found a happy path to the password reset
workflow. To eat my own dog food, I wrote the whole interaction with AGJS (thanks a lot
Luke for your patience).
Details about the project:
url: https://github.com/abstractj/password-reset/
tag: 0.1.0
Dependencies: The following PR must be locally installed
https://github.com/aerogear/aerogear-crypto-java/pull/14
The package “api” is what I would suggest to move to another project like ag-security for
example and the other packages are mostly up to the implementer.
Configuration files:
- The project has 2 configuration files
web.xml:
<init-param>
<param-name>url</param-name>
<param-value>http://localhost:8080/password-reset/</param-value>
</init-param>
<init-param>
<param-name>redirect-page</param-name>
<param-value>/reset/update.html</param-value>
</init-param>
The “url” parameter is used by the project to provide the urls
like: http://localhost:8080/password-reset/reset?id=CMZXGXLg%2Fw7nCBrlmEB%2BO6iDMHzxNSf8cD5idyDxS8U%3D
and “redirect-page” is the page to be redirected when the correct token id is provided.
config.properties:
secret_key = "d9eb5171c59a4c817f68b0de27b8c1e340c2341b52cdbc60d3083d4e8958532"
\
“18dcc5f589cafde048faec956b61f864b9b5513ff9ce29bf9e5d58b0f234f8e3b"
“secret_key” will be the passphrase used by PBKDF2 to HMAC a new token and can’t be
shared.
How to test it?
- git clone https://github.com/abstractj/password-reset/ && cd password-reset
&& mvn clean package
Scenarios for testing:
- Workflow I
1. Open http://localhost:8080/password-reset/ at your browser
2. Input whatever e-mail and click on reset
3. At your console an URL will be printed at your logs. For example:
http://localhost:8080/password-reset/reset?id=CMZXGXLg%2Fw7nCBrlmEB%2BO6i...
4. Copy & paste it into your browser
5. If everything went well, you will probably see the update page. Input the e-mail, new
password and the confirmation
6. Now try to send a request to the same URL and you will get a 404 (This is intentional,
because the token was used & destroyed)
- Workflow II
1. Try to request the update.html page
2. You should get a 404 because you’re not allowed to do it without a valid token
- Workflow III
1. Try to request http://localhost:8080/password-reset/reset/?id=“Some random or repeated
id here”
2. You should get a 404 because you’re not allowed to do it without a valid token
- Workflow IV
1. Change the value
of https://github.com/abstractj/password-reset/blob/master/src/main/java/...
to -10 for example.
2. Input whatever e-mail and click on reset
3. At your console an URL will be printed at your logs. For example:
http://localhost:8080/password-reset/reset?id=CMZXGXLg%2Fw7nCBrlmEB%2BO6i...
4. Copy & paste it into your browser
5. You should get a 404 because this token has already expired.
Open questions
- The usability is easy, tricky..the configuration files are too much?
- Where the package “api” should be added? ag-security? nowhere?
- Is the workflow ok for you?
Thoughts, suggestions?
--
abstractj