Forgot password

At the end of this guide, you will have a complete password recovery system with secure token verification.

The forgot password component allows users to reset their password by verifying their email address. When a user requests a password reset, they receive an email with a secure link that takes them to a form where they can set a new password. For security, the system does not reveal whether an account exists for a given email address.

The component includes:

• Email-based password reset requests
• Secure token generation and verification
• Form to request a reset link
• Form to set a new password
• Rate limiting using the formsThrottle middleware
• Email throttling (one email per minute per address)