UI workflow
Scenario
Password Reset
Request a reset link (no real email — it's shown directly), follow the token-bearing link, set a new password, then log in with it. The new password is real for the rest of your session.
How this works
- · No real email is sent — the Check Email page just shows the reset link directly, with the token embedded in the URL, since simulating an inbox isn't the point of the drill.
- · The token is a random UUID stored in its own httpOnly cookie with a 10-minute expiry — it is validated against that cookie, not decoded from the URL alone, so a copied link from a different browser session will not work.
- · Setting a new password writes a per-session password override (there's no real user database) — only your own session's login accepts the new password afterward; other sessions still use the original.
What you'll practice
- A token embedded in a URL — extract it, reuse it, or tamper with it
- A token that's genuinely single-use and expires (10 minutes) — try reusing an already-used link
- Client-side password-confirmation matching, plus the server rejecting a mismatch too
- The new password is real for the rest of your session — log in elsewhere on the site afterward and the old password stops working
- 1 Request →
- 2 Check Email →
- 3 New Password →
- 4 Login →
- 5 Done