Policy and Reset

Modern password guidance is shorter than people expect. Length matters far more than composition rules. Forced rotation makes passwords worse, because people iterate a number on the end. Composition rules push people towards Password1!, which is both hard to remember and easy to guess.

What actually helps: a decent minimum length, checking against lists of known-breached passwords, and not blocking password managers by disabling paste.

A reset flow has four requirements, and getting any wrong is a full account takeover.

The token must be random and long, not derived from anything guessable.

It must expire, in hours rather than days.

It must be single use, invalidated once used or once the password changes.

The response must be the same whether or not the account exists, or the form becomes a way to discover who has an account.

And changing a password should invalidate existing sessions, or somebody who got in stays in.

◈ Graded Challenge

Write check_token(token, now) validating a password reset token. token is a dictionary with issued_at and expires_at as numbers, used (a boolean), and invalidated (a boolean). now is a number. Return "ok" when the token may be used. Return "expired" when now is at or past expires_at. Return "used" when it has already been used. Return "invalidated" when it was invalidated, which happens when the password changed after it was issued. Check invalidated first, then used, then expired.

Name it exactly: check_token(token, now)

Python3 visible + 4 hidden

loading editor…

Mark this lesson complete

Signed in, your progress follows you to every device.

Next: Practice Test →

← Back