CS50 Stack Exchange is a question and answer site for students of Harvard University's CS50. It only takes a minute to sign up.
Sign up to join this community
I'm up to the extra feature and I want to implement a reset password feature. To keep it safe, I'm asking the user for their username and then I want to send them an email with their password. However the users table (for security reasons as explained in David Malan's lecture) only contains the hashed version.
So my question is, is there a function or a way to get the user's original password back?
From php manual
password_hash() creates a new password hash using a strong one-way hashing algorithm.
one-way being the operative.
More info on cryptographic hashing here. Or check out any of the other 2 million+ hits from Google for "one way hash".
As a user I wouldn't be happy to see a password sent via email in plaintext!
Before you can add a feature to allow users to reset a forgotten password, you will need to add a simpler feature: create a Controller and View that will allow an authenticated user (already logged in) to change their password to a new one -- perhaps only after entering their current, valid password.
Once you have done that, you can use a similar mechanism to allow an un-authenticated user (one who is not logged in) to change their password to a new one -- this time, without requiring them to enter a current, valid password, since, after all, they have forgotten it!
For this second feature, you will need to create a Controller and View that are very similar to the one I mentioned in the paragraph above, minus only the field for the current password (and the logic required to validate the current password.)
You are on the right track with sending the user an email. However, emailing passwords in plaintext is a security no-no, as @DinoCoderSaurus has mentioned.
A better solution would be to create an ephemeral URL to display the "Reset Forgotten Password" View, and then email that URL to the user. You could create a reset_forgotten.php Controller that displays a form saying "Forgot your password? Enter your userid in this box, or your e-mail address in this other box, and we will email you a link to reset your password." -- unless a certain long random string happens to be passed as an HTTP GET query string, in which case it will display a reset_forgotten_form.php View.
I leave the implementation to you. I'll just mention that there are already some PHP functions used to generate cryptographic hashes such as SHA and MD5. You could use one of these to generate a long string, then store it in a new database table along with the ID of the user requesting a reset. Then, once the reset_forgotten_form.php View is displayed once, you would want to remove that row from the table so that the same link would never work again.
By the way, if this helps to answer your question, please click on the green checkmark. Help keep our forum safe from undead zombie questions!
if (password_verify($_POST["password"], $row["hash"]))
You can use this function to verify, you can see this login.php aswell.
