Skip to content
arch-lab

Password reset — one-time link

A reset that survives a lost inbox: the link is single-use and the old session dies.

Open in the playground

Account holderWeb App[Next.js]−Hide the 3 services only Web App usesAuth Service[Go]−Hide the 2 services only Auth Service usesToken Store[Redis]Email Provider[Postmark]loop[until the link is used or expires]alt[token valid][token missing or expired]Same response whether or not the addressexists1. Requests a reset2. Ask for a reset link [HTTPS]3. SET token, ttl 15m [RESP]4. Send reset link [SMTP]5. 202 Accepted6. Opens the emailed link7. POST /reset-confirmations [HTTPS]8. GETDEL token [RESP]9. Hashes the new password10. Revoke every session11. 200 OK12. Signed in with the new password13. 410 Gone14. Asks for a fresh reset
  1. Account holder to Web App (solid line with an arrowhead): Requests a reset
  2. Web App to Auth Service (solid line with an arrowhead): Ask for a reset link [HTTPS]
  3. Auth Service to Token Store (solid line with an arrowhead): SET token, ttl 15m [RESP]
  4. Auth Service to Email Provider (solid line with an open head): Send reset link [SMTP]
  5. Auth Service to Web App (dotted line with an arrowhead): 202 Accepted
  6. Account holder to Web App (solid line with an arrowhead): Opens the emailed link
  7. Web App to Auth Service (solid line with an arrowhead): POST /reset-confirmations [HTTPS]
  8. Auth Service to Token Store (solid line with an arrowhead): GETDEL token [RESP]
  9. Auth Service to Auth Service (solid line with an arrowhead, self-message): Hashes the new password
  10. Auth Service to Token Store (solid line with an open head): Revoke every session
  11. Auth Service to Web App (dotted line with an arrowhead): 200 OK
  12. Web App to Account holder (solid line with an arrowhead): Signed in with the new password
  13. Auth Service to Web App (dotted line with an arrowhead): 410 Gone
  14. Web App to Account holder (solid line with an arrowhead): Asks for a fresh reset