really loved the tutorial, it's perfect how you only focus on the topic and not other things. Thanks a lot.

Thanks for the video! It's easy to learn. I like the way you skip the unimportant part and only focus on password reset!

I really loved your explanation. It was straight to the point, without any unnecessary bullshit. Plain, simple, and easy to follow for resetting the password. Good job!

Thanks for providing such a clear tutorial on how to do this. Much appreciated!

Right on the point and so clear thank you so glad I'v found this channel man keep it up

This is so frickin' clear. Thank you pal!!!

I like the way we can leverage JWT to create a token which helps us to create one-time link. Useful tutorial!

Ahh thank you so much! I've been looking for this for almost a week. The other videos on YT all use randomly generated crypto tokens, but I wanted to use JWT instead. This was a life saver, and very well explained. Thanks again man!

Love these node tutorials

Clear and simple. Thanks my friend

best video in the youtube for the reset password technique

This was excellent, thank you!

Thank you, very clear explanation

Thank you so much, it really helped me!

Very informative. Thanks⚡️

Thank you so much, this is so helpful

One suggestion for all. Instead of generating jwt secret using a secret key+user old password, use crypto to generate a new secret key each time user wants to reset the password and store the secret key in your database. When user successfully resets the password, just delete the secret key from database so that it cant be used again.

Thanks this tutorial very helpfull

thank you sir easy explanation af

Great tutorial ❤️

thanks you for your clear explanation , i have a doubt regarding where the token is storage in the project , is into cache?

Thanks you so much for this video.. thanks to you i have able to complete this authentication part smoothly. I find many challenges when using the same code with database but little by little debugging finally i happen to get to the same result.. Your content is really worked with real case scenario. I really appreciate the time and effort you took to explain the process concisely.

Thank you so much

Great video! Subscribed to channel. Thank you.

@jakubgadzala7474

2 жыл бұрын

So, I have watched it earlier today. By now I have watched it second time and implemented into my project without any hussle whatsover! The quality of your tutorial is better than many I have watched on udemy. They usually talk to much or not clear enough. Your explanation was perfect, step by step, easy to replicate in any project. Thank you a milion again sir!

Thank you. This videao is very helpful.

Amazing video bro , simple and clear explanation

@mafiacodes

2 жыл бұрын

Glad it helped

Thanks brother

Superb 🔥🔥

Thanks for tutorials! really helpful.

your videos are of very high quality.

@mafiacodes

3 жыл бұрын

I appreciate that! Thank you!

great video as always please also make videos on MERN full stack videos

Please provide a link to the code in the description. That would be awesome.

Thankyou much ))

amazing channel

Which font you are using can you please tell me?

tks so much

Thanks this helps me a lot..

@mafiacodes

2 жыл бұрын

Subscribe like share

Bro you are my superman, for my deadlines

@mafiacodes

2 жыл бұрын

Subscribe like share

@jonathanlozanoh4231

Жыл бұрын

@@mafiacodes yes

Ohoo sir... i will use it in your RBAC website

Can you tell me what font is used in Vs code ?

awesomeeeeee......

help alot....

Thanks, Bro! It helps a lot 👍☺

Please provide a link to the code in the description. That would be awesome. Thanks :D

Which vscode theme color do you use?

How do I get the user from the database from the reset password link? We didn't need a request.body

Sir hello one time paasword means if you failed to use the first otp that google send...google will not send another otp again???..is that mean of otp....or they send again?? but in some other time or day??.because i reiceve my otp but accidentally i cancel my request for reset password link .then i fill up again in google recovery form and option to submit not show again..is it because i failed to use my first code???how can i get again... hope you answer me..thank you sir

please how can i set it to get the email and password in my database

For some reason jwt verify is returning false , basicaly it's not working

Awesome

If the user re-enters the old password, then the token will still be valid until it expires, right?

Suppose my boss is giving me existing code written by others, now they provide me their api..now how to test and properly integrate in frontend (.ejs) ..can you make a video on this topic

Does this work on iOS or do we have to use universal links ?

you're my pal

Fantastic video, congratulations. Could you tell me what vscode theme you were using?

@mafiacodes

2 жыл бұрын

Snazzy operator

Great explanation, thank you very much!! Is it best practice to use the current password for the jwt secret in this way? I get that the secret is never sent to the client, but it still feels like it might be a an unnecessary risk. I'd be interested to know your thoughts.

@mafiacodes

2 жыл бұрын

No problem at all, moreover it’s more secure since we are creating a secret using a common secret and hashed password , so no worries with that

@codingprojects4002

Жыл бұрын

Its safe to use it.. because your current password is hashed and u r using that hash plus jwt secret so no one can decode it.. even if u get hashed password text u can't get password from it.. it is secure

Pls can you share your vs code profile i like your extensions

does have any git repo??

Sir I tried with database but not working please help me with this problem.

I have one question. Can a similar approach be taken for user's email validation when a user signs up? Great video. Thanks a lot.

@mafiacodes

3 жыл бұрын

Yes, absolutely

@arnobchowdhury9641

3 жыл бұрын

@@mafiacodes Thanks a lot for the reply.

@danielsouza1824

3 жыл бұрын

I did the signup process with jwt. With an email validation to activate account.

@MahadyHasan

2 жыл бұрын

you can check the signs-up email address on the user table on the database. If the email already exists, an error message can show." this email already registered", otherwise signs up will continue.

Can we send email of the user in the url apart from id of the user Btw great content :-)

Your explanation is soo good

@mafiacodes

Жыл бұрын

Glad it was helpful!

It is not one-time link if the user sets exactly the same password. It should've been generated private key, stored on distributed fs or memory until user changed their password. Once done you remove the key. Obviously you need to have a dedicated authorization mechanism just for this endpoint.

I have one doubt. Like during sign up i store token in database.. so is again need to generate token for reset password or i fetch from database??

@snehabaser3155

3 жыл бұрын

Please reply as early as possible. It would be great help!

@mafiacodes

3 жыл бұрын

u have to watch the full video to understand how it works, it has nothing related to signups...

@danielsouza1824

3 жыл бұрын

The token is never stored, only generated and saved in the client side (maybe in your mailbox)

where can i find the source code

sir what if i am using env variable for JWT secret key and not not using password in the secret like you did only using the env variable for storing secret will it give invalid signature

@mafiacodes

3 жыл бұрын

U can only use env variable but in that case the link will be valid for lifetime of the token even if it has been used once to reset a password

@riteshthakur9250

3 жыл бұрын

@@mafiacodes so i will have to use the password with jwt secret for not use it more than one time once it is used

@mafiacodes

3 жыл бұрын

Yes

@danielsouza1824

3 жыл бұрын

That was awesome, I was looking for this kind of answer, how to generate unique token regarding the reset password, to not be valid after the process.

nice video,please make video on otp based login system

@mafiacodes

3 жыл бұрын

Yeah coming up

@technoinfoworldwide2329

3 жыл бұрын

@@mafiacodes when it will come sir?waiting for it

great job

if user1 have a link to reset password that I have, that mean user1 can reset password on my account ?

@mafiacodes

3 жыл бұрын

no each one can reset only his password

where is your git

Good Work Bro Keep It Up Bro Can u plz provide the source code

@mafiacodes

Жыл бұрын

I'll check if I have saved it...

@yoursTRULY it says "Cannot GET /reset-password/qwerty12".

@khushboogoyal27khush

3 жыл бұрын

```const express = require("express"); const jwt = require("jsonwebtoken"); const app = express(); app.use(express.json()); app.use(express.urlencoded({extended: false})) app.set("view engine", "ejs") let user = { id: "qwerty12#45", email: "k@gmail.com", password: "qwer123@#$fghj" } //To create a token we need secret. const JWT_SECRET = "some super secret..." app.get("/", (req, res) => { res.send("Hello World!") }) app.get("/forgot-password", (req, res, next) => { res.render("forgot-password"); }) app.post("/forgot-password", (req, res, next) => { const {email} = req.body; //res.send(email); //make sure user exist in DB. if(email !== user.email){ res.send("User not registered") return; } //user exist and now create one time link that is valid for 15 mins. //we need to create one more secret because we dont want that user can use the same link even after 15mins completed. const secret = JWT_SECRET + user.password; //this payload will be stored inside our JWT token. const payload = { email: user.email, id: user.id } const token = jwt.sign(payload, secret, {expiresIn: "15m"}); //generating link through this token. const link = `localhost:3000/reset-password/${user.id}/${token}`; console.log(link); //we can use transactional emails here. res.send("Password reset link has been sent to your email."); }); app.get("/reset-password/:id/:token", (req, res, next) => { const {id, token} = req.params //check if this id exist in DB. if(id !== user.id){ res.send("Invalid ID...") return } //we have a valid id and we have a valid user with this id. const secret = JWT_SECRET + user.password; try{ const payload = jwt.verify(token, secret) res.render("reset-password", {email: user.email}) } catch(error){ console.log(error.message); res.send(error.message); } }) app.post("/reset-password/:id/:token", (req, res, next) => { const {id, token} = req.params; const {password, password2} = req.body; //check if this id exist in DB. if(id !== user.id){ res.send("Invalid ID...") return; } const secret = JWT_SECRET + user.password try{ const payload = jwt.verify(token, secret) //validate password and password2 should match. //we can simple find the user with the payload, email and id and finally update with new password. //always hash the password before saving. user.password = password res.send(user) } catch(error){ console.log(error.message); res.send(error.message) } res.send(user); }) app.listen(3000, ()=>{ console.log(`localhost:3000`) })```

@mafiacodes

3 жыл бұрын

That is an invalid url

@khushboogoyal27khush

3 жыл бұрын

@@mafiacodes but the code is exactly same as you have explained. can you plz share the source code of it?

@khushboogoyal27khush

3 жыл бұрын

@yoursTRULY now that error is gone and the code is working fine. but when i submit entries for password and confirm password it gives me some errors. although that page redirect to another page and displayed the desired data. it says this in my console - Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client at ServerResponse.setHeader (_http_outgoing.js:558:11) at ServerResponse.header (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:771:10) at ServerResponse.send (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:170:12) at ServerResponse.json (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:267:15) at ServerResponse.send (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:158:21) at /Volumes/khush/downloads/forgot-password/app.js:96:9 at Layer.handle [as handle_request] (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/layer.js:95:5) at next (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/route.js:137:13) at Route.dispatch (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/route.js:112:3) at Layer.handle [as handle_request] (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/layer.js:95:5)

@editingtuto1.011

2 жыл бұрын

Same problem is occurring with me too

Link to source? Will help in debugging errors. Thank you

@mafiacodes

3 жыл бұрын

I will

@josephjoey3904

3 жыл бұрын

@@mafiacodes Thanks bro

hi

Great video but we need this with db.

@mafiacodes

3 жыл бұрын

easy to do, just follow the logic

@Pravesh-Dwivedi

3 жыл бұрын

Sir please make this video with db

Code link?

Fala mais devagar moço, por favor. Tem criança chorando aqui

@mafiacodes

2 жыл бұрын

noted with thanks

Is this free

I'm getting "invalid id".... Actually I tried to use mongodb database for this.... I checked it, I'm getting the value of res.send(user.id).... but I'm not getting any value for res.send(id)... So it's not matching... Hence it is showing undefined What can I do for this problem?

Help me bro for my Instagram account I forget ten my password email is not working number is not working backup code are not working what can I do bro help me but my account is active I can't log in help me bro😢

this is hackable if I want to hack johndoe account it is easy to do so if I no johndoo id, I will reset my account and pass in john doe id in the URL and reset it. you are not verifying the token with the id.