Lizandro GuarnizoandClaude Sonnet 4.6
e937676160
- login.html: corregir link roto /password/reset → /request-password-reset
- request-password-reset.html: reescribir — pide email, AJAX, diseño de la app
- RequestPasswordResetPost: buscar por email (GetUserByEmail), no revela si
el correo existe o no (misma respuesta siempre — seguridad)
- password-reset.html: reescribir — eliminar campo nombre_usuario redundante,
validación de contraseñas en cliente, diseño consistente con el resto del app
- PasswordResetPost: usar c.Locals("email") del token (ya validado por
middleware) en vez de nombre_usuario del form
- password_reset.go middleware: ampliar expiración de token de 5 min a 1 hora
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
59 lines
1.3 KiB
Go
Executable File
59 lines
1.3 KiB
Go
Executable File
package middlewares
|
|
|
|
import (
|
|
"errors"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/sujit-baniya/fiber-boilerplate/utils"
|
|
|
|
"github.com/gofiber/fiber/v2"
|
|
"github.com/sujit-baniya/fiber-boilerplate/app"
|
|
)
|
|
|
|
func ValidatePasswordReset(c *fiber.Ctx) error {
|
|
token := c.Query("t")
|
|
err := _validatePasswordReset(c, token)
|
|
if err != nil {
|
|
return app.Http.Flash.WithError(c, fiber.Map{
|
|
"message": err.Error(),
|
|
}).Redirect("/token-vencido")
|
|
}
|
|
return c.Next()
|
|
}
|
|
|
|
func ValidatePasswordResetPost(c *fiber.Ctx) error {
|
|
token := c.Params("token")
|
|
err := _validatePasswordReset(c, token)
|
|
if err != nil {
|
|
return app.Http.Flash.WithError(c, fiber.Map{
|
|
"message": err.Error(),
|
|
}).Redirect("/login")
|
|
}
|
|
return c.Next()
|
|
}
|
|
|
|
func _validatePasswordReset(c *fiber.Ctx, t string) error {
|
|
t = utils.Decrypt(t, app.Http.Server.Key)
|
|
emailParts := strings.Split(t, "-reset-")
|
|
if len(emailParts) != 2 {
|
|
return errors.New("Invalid Password Reset Token")
|
|
}
|
|
|
|
tokenTS, err := strconv.ParseInt(emailParts[1], 10, 64)
|
|
if err != nil {
|
|
return errors.New("Invalid Password Reset Token")
|
|
}
|
|
now := time.Now().Unix()
|
|
diff := now - tokenTS
|
|
if diff > (60 * 60) {
|
|
return errors.New("Password Reset Token has expired!")
|
|
} else if diff < 0 {
|
|
return errors.New("Invalid Password Reset Token")
|
|
}
|
|
c.Locals("email", emailParts[0])
|
|
c.Locals("token", t)
|
|
return nil
|
|
}
|