Skip to content

feature(securité): Fournir un lien pour mettre à jour le mot de passe - #2430

Open
vgreb wants to merge 2 commits into
afup:masterfrom
vgreb:security/token-reset-password
Open

vgreb wants to merge 2 commits into
afup:masterfrom
vgreb:security/token-reset-password

Conversation

@vgreb

@vgreb vgreb commented Oct 12, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

->table('afup_password_reset_tokens', ['id' => false, 'primary_key' => ['user_id']])
->addColumn('user_id', 'integer', ['signed' => false, 'null' => false])
// SHA-256 du jeton : le jeton en clair n'existe que dans l'e-mail.
->addColumn('token_hash', 'string', ['limit' => 64, 'null' => false])

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion : utiliser le terme token tout simplement.

{
$plainToken = bin2hex(random_bytes(32));
$now = $this->clock->now();

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion : Peut être jouer une requête SQL avant pour nettoyer cette table, non ?

DELETE ... WHERE expires_at < NOW()

vgreb added 2 commits October 15, 2026 23:07
…pirés

- Remplace « jeton » par « token » dans les commentaires.
- Supprime les tokens expirés à chaque nouvelle demande de réinitialisation.
@vgreb
vgreb force-pushed the security/token-reset-password branch from c0beda8 to 690e426 Compare October 15, 2026 21:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants