Glad it helped

So, I have watched it earlier today. By now I have watched it second time and implemented into my project without any hussle whatsover! The quality of your tutorial is better than many I have watched on udemy. They usually talk to much or not clear enough. Your explanation was perfect, step by step, easy to replicate in any project. Thank you a milion again sir!

I appreciate that! Thank you!

Glad it was helpful!

Subscribe like share

@@mafiacodes yes

Subscribe like share

No problem at all, moreover it’s more secure since we are creating a secret using a common secret and hashed password , so no worries with that

Its safe to use it.. because your current password is hashed and u r using that hash plus jwt secret so no one can decode it.. even if u get hashed password text u can't get password from it.. it is secure

Snazzy operator

Yes, absolutely

@@mafiacodes Thanks a lot for the reply.

I did the signup process with jwt. With an email validation to activate account.

you can check the signs-up email address on the user table on the database. If the email already exists, an error message can show." this email already registered", otherwise signs up will continue.

Yeah coming up

@@mafiacodes when it will come sir?waiting for it

I'll check if I have saved it...

easy to do, just follow the logic

Sir please make this video with db

Please reply as early as possible. It would be great help!

u have to watch the full video to understand how it works, it has nothing related to signups...

The token is never stored, only generated and saved in the client side (maybe in your mailbox)

I will

@@mafiacodes Thanks bro

U can only use env variable but in that case the link will be valid for lifetime of the token even if it has been used once to reset a password

@@mafiacodes so i will have to use the password with jwt secret for not use it more than one time once it is used

Yes

That was awesome, I was looking for this kind of answer, how to generate unique token regarding the reset password, to not be valid after the process.

no each one can reset only his password

noted with thanks

```const express = require("express"); const jwt = require("jsonwebtoken"); const app = express(); app.use(express.json()); app.use(express.urlencoded({extended: false})) app.set("view engine", "ejs") let user = { id: "qwerty12#45", email: "k@gmail.com", password: "qwer123@#$fghj" } //To create a token we need secret. const JWT_SECRET = "some super secret..." app.get("/", (req, res) => { res.send("Hello World!") }) app.get("/forgot-password", (req, res, next) => { res.render("forgot-password"); }) app.post("/forgot-password", (req, res, next) => { const {email} = req.body; //res.send(email); //make sure user exist in DB. if(email !== user.email){ res.send("User not registered") return; } //user exist and now create one time link that is valid for 15 mins. //we need to create one more secret because we dont want that user can use the same link even after 15mins completed. const secret = JWT_SECRET + user.password; //this payload will be stored inside our JWT token. const payload = { email: user.email, id: user.id } const token = jwt.sign(payload, secret, {expiresIn: "15m"}); //generating link through this token. const link = `localhost:3000/reset-password/${user.id}/${token}`; console.log(link); //we can use transactional emails here. res.send("Password reset link has been sent to your email."); }); app.get("/reset-password/:id/:token", (req, res, next) => { const {id, token} = req.params //check if this id exist in DB. if(id !== user.id){ res.send("Invalid ID...") return } //we have a valid id and we have a valid user with this id. const secret = JWT_SECRET + user.password; try{ const payload = jwt.verify(token, secret) res.render("reset-password", {email: user.email}) } catch(error){ console.log(error.message); res.send(error.message); } }) app.post("/reset-password/:id/:token", (req, res, next) => { const {id, token} = req.params; const {password, password2} = req.body; //check if this id exist in DB. if(id !== user.id){ res.send("Invalid ID...") return; } const secret = JWT_SECRET + user.password try{ const payload = jwt.verify(token, secret) //validate password and password2 should match. //we can simple find the user with the payload, email and id and finally update with new password. //always hash the password before saving. user.password = password res.send(user) } catch(error){ console.log(error.message); res.send(error.message) } res.send(user); }) app.listen(3000, ()=>{ console.log(`localhost:3000`) })```

That is an invalid url

@@mafiacodes but the code is exactly same as you have explained. can you plz share the source code of it?

@yoursTRULY now that error is gone and the code is working fine. but when i submit entries for password and confirm password it gives me some errors. although that page redirect to another page and displayed the desired data. it says this in my console - Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client at ServerResponse.setHeader (_http_outgoing.js:558:11) at ServerResponse.header (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:771:10) at ServerResponse.send (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:170:12) at ServerResponse.json (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:267:15) at ServerResponse.send (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/response.js:158:21) at /Volumes/khush/downloads/forgot-password/app.js:96:9 at Layer.handle [as handle_request] (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/layer.js:95:5) at next (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/route.js:137:13) at Route.dispatch (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/route.js:112:3) at Layer.handle [as handle_request] (/Volumes/khush/downloads/forgot-password/node_modules/express/lib/router/layer.js:95:5)

Same problem is occurring with me too