java - 如何通过在java中向用户发送邮件来创建密码重置链接的链接

Question

 String messageValue[] = {userNameFull, programName, url, url, newPass, programSupportEmail, programSupportEmail, programSupportPhone, signature, programWebsite};

            //String subject = MessageUtil.getMessage("mail.ResetPasswordSubject", locale);
            //String message = MessageUtil.getDynamicMessage("mail.UserMailForgotPassword", messageValue, locale);;
            //mail.ResetPasswordSubject = Password Reset Request
            String subject = "Password Reset Request";
            String message = "Dear {0}"
                    + ",<br/>"
                    + "Greetings from the {1} Team."
                    + "<br/><br/>"
                    + "Your password has been reset."
                    + "<br/><br/>"
                    + "To access your account, "
                    + "please click on the following link:<br/>"
                    + "<a href={2}>{3}</a>"
                    + "<br/>"
                    + "or copy the link and paste it in your browser&#39s address bar."
                    + "<br/><br/>"
                    + "Your temporarily reset password will expire in 7 days "
                    + "and you will be asked to change it on your first login."
                    + "<br/>Login to your account using the following details:"
                    //+ "<br/><br/>Password:{4}"
                    //+ "<br/><br/>Password:"+newPass+""

在这里我必须输入重置密码的链接来代替此“

密码:”+newPass+“”请帮助我

Answer 1

请按照以下步骤从安全角度避免暴力攻击。

1. 创建 32 个字符的字母数字字符串作为 sessionid，其有效期为 7 天(根据您的情况)
2. 创建代码 8/12 字符构象代码
3. 将带有 sessionid 的重置链接放入查询参数中，将配置代码放入电子邮件中。
4. 当用户点击链接时，让他在 ui 上插入配置代码。
5. 验证 session ID 和配置代码
6. 所有内容均有效，然后向他显示他的用户名并要求新密码和确认密码。