News for hackers. Stuff that matters.

A comment on Is Your Site Leaking Password Reset Links?. Parent comment

Re:Is Your Site Leaking Password Reset Links? by nileshtrivedi on Monday October 24, 2016 @08:33AM (#12778215)
How to implement this if the token is not stored in database at all (eg. JWT)? As far as I know, enforcing one-time-use only requires storing a bit in backend.
[ Parent | on HN ]
Re:Is Your Site Leaking Password Reset Links? by anton_gogolev on Monday October 24, 2016 @09:23AM (#12778500)
If you could somehow encode the value of "PasswordLastUpdatedAt" in your token, you will then could have truly "stateless" tokens.
[ Parent | on HN ]