Implement a complete Forgot Password & Reset Password system, including:
- Frontend pages (Forgot Password & Reset Password)
- Backend APIs for password recovery
- Secure token generation, validation, and expiry
- Email-based reset flow
This feature enables users to securely recover access to their accounts.
🎯 Scope of Work
✅ Frontend (React)
- Forgot Password page
- Reset Password page
- API integration
- Validation, loading states, and UX feedback
✅ Backend (Node.js + Express)
- Create password recovery APIs
- Secure token handling
- Password update logic
- Email dispatch
🖥️ Frontend Requirements
1️⃣ Forgot Password Page
UI Fields
Behavior
- Validate email format
- Submit email to backend API
- Show generic success message (do not reveal user existence)
- Handle loading and error states
2️⃣ Reset Password Page
UI Fields
- New Password
- Confirm New Password
Behavior
- Read reset token from URL
- Validate password strength
- Ensure password match
- Submit new password to backend
- Redirect to Login after success
🔗 Backend API – To Be Created
1️⃣ Forgot Password API
POST /api/auth/forgot-password
Request Body
{
"email": "user@example.com"
}Backend Logic
- Check if user exists (do not expose result)
- Generate secure random token
- Hash token before storing
- Save token + expiry in DB
- Send reset email with URL
Response
{
"message": "If the email exists, a reset link has been sent."
}
2️⃣ Reset Password API
POST /api/auth/reset-password/:token
Request Body
{
"password": "NewStrongPassword123"
}Backend Logic
- Hash incoming token
- Match token + expiry
- Hash new password (argon2 / bcrypt)
- Update user password
- Clear reset token & expiry
Response
{
"message": "Password reset successful"
}
🗄️ Database Changes
User Schema Additions
resetPasswordToken: string | null
resetPasswordExpire: Date | null
- Token must be stored hashed
- Expiry time: 10–15 minutes
🔒 Security Requirements
- Use
crypto.randomBytes() for tokens
- Hash reset tokens before storing
- Do not reveal if email exists
- Enforce strong password rules
- Invalidate token after use
- Never log sensitive data
⚠️ Error Handling
- Invalid or expired token
- Weak password
- API failure
- Email service failure
- All errors must be user-safe messages
✅ Acceptance Criteria
🛠️ Tech Stack
- Frontend: React, Axios / Fetch
- Backend: Node.js, Express
- Database: MongoDB
- Security: crypto, argon2 / bcrypt
- Email: Nodemailer / SMTP / Email Provider
📎 Notes
- Use environment variables for secrets & email config
- Keep auth logic inside
/auth module
- Follow existing controller/service pattern
- Email sending can be mocked in development
Implement a complete Forgot Password & Reset Password system, including:
This feature enables users to securely recover access to their accounts.
🎯 Scope of Work
✅ Frontend (React)
✅ Backend (Node.js + Express)
🖥️ Frontend Requirements
1️⃣ Forgot Password Page
UI Fields
Behavior
2️⃣ Reset Password Page
UI Fields
Behavior
🔗 Backend API – To Be Created
1️⃣ Forgot Password API
Request Body
{ "email": "user@example.com" }Backend Logic
Response
{ "message": "If the email exists, a reset link has been sent." }2️⃣ Reset Password API
Request Body
{ "password": "NewStrongPassword123" }Backend Logic
Response
{ "message": "Password reset successful" }🗄️ Database Changes
User Schema Additions
🔒 Security Requirements
crypto.randomBytes()for tokens✅ Acceptance Criteria
🛠️ Tech Stack
📎 Notes
/authmodule