Backend Feature Request: Forgot Password Endpoint

[hashim6789]

Forgot Password Feature Implementation

Description

We need to implement a Forgot Password endpoint to allow users to securely request a password reset link in case they forget their password. This will enhance the security and usability of the Inker platform.

Feature Requirements

1. Forgot Password Endpoint

• Create a new API endpoint /api/auth/forgot-password to handle forgot password requests.
• Accept a request body containing the user's email address.
• Validate the provided email address to ensure it is associated with an existing account.
• Generate a unique password reset token with an expiration time (e.g., 24 hours).
• Send an email containing the password reset link with the token to the user's email address.

2. Token Generation and Storage

• Implement logic for generating secure, unique tokens.
• Store the generated tokens in the database, associated with the user's email and expiration time.
• Ensure that tokens are securely stored and are not easily guessable.

3. Email Service Integration

• Integrate with an email service provider to send password reset emails.
• Use a predefined email template to create user-friendly emails containing the password reset link.

API Specification

Endpoint: Forgot Password Request

Method: POST
URL: /api/auth/forgot-password

Request Body

{
  "email": "user@example.com"
}

Response (Success)

Status Code: 200 OK

{
  "status":200,
  "message": "Password reset link has been sent to your email."
}

Response (Failure - Invalid Email)

Status Code: 400 Bad Request

{
  "error": "Invalid email address or user does not exist."
}

Security Considerations

• Ensure rate limiting to prevent abuse of the forgot password endpoint.
• Encrypt the reset token before storing it in the database.
• Implement email verification to prevent unauthorized reset attempts.
• Set expiration time (e.g., 24 hours) for the reset token.

Next Steps

• Implement the Reset Password endpoint to allow users to update their password using the reset token.
• Add frontend integration for password reset requests.
• Test the implementation with different email providers and edge cases.

[AJMALAJU3]

@hashim6789 Have you completed this issue?