create forgot password endpoint about sgf-legacy HOT 3 OPEN

We probably need to add a couple of other issues around this. We should:

1. Send an email to Verify the user's email.
2. Verify the user's email.
3. Then we can send an expiratory link to reset it.

• Then this issue.

from sgf-legacy.

@zrmeier
Apologies for being late to this but do you mean every time a user wishes to reset their password the system checks to verify their current email by sending an email to their registered address before sending out a password reset link? If that is the case not sure what the current industry take on that is but might have some security implications. If I've misunderstood please let me know as I think security is very important and that we should verify all emails on sign up and then trust them until the user requests to change their registered email.

from sgf-legacy.

I think that sounds fine. I think @zrmeier is talking about what happens when you forget your password on a lot of sites - they send a password reset link, or a verification code to your email, and then you get to reset your password

from sgf-legacy.