Security with Go

Resetting the password

Avoid allowing email spam. Rate limit the emails sent so that an attacker cannot spam your users by submitting the forgot password form multiple times.

When creating a reset token, ensure that it has good entropy so that it can't be guessed. Don't just create a token based on the time and the user ID because that can be guessed and brute forced too easily, as it lacks enough entropy. You should use at least 16-32 random bytes for a token to have decent entropy. Refer to Chapter 6, Cryptography, for examples of generating cryptographically secure random bytes.

Also, set the token to expire after a short period. Anywhere from one hour to one day are good options depending on your application. Only allow one reset token ...