OC hey that everyone had their share.
And welcome to another video.
Now in this video, I will give you a brief walkthrough that how the forgot password feature actually
works.
Now, by understanding this, you will also understand that in case you want to allow the feature of
verifying the user and their verifying their email, also, this is exactly how it works.
A lot of time people just work into the code itself.
That's why they are not able to visualize this properly.
Once you understand this here, writing the code for it is going to be much, much easier.
So let me show you that, how it works.
So this is the database that you have created.
It can be MongoDB, MySQL, whatever.
This is an abstraction concept and it works exactly same everywhere.
And this is you with your computer or your laptop, whatever you are doing.
Now, let's just say you have forgot your password.
So what happens is you actually make a request that, hey, I have forgot my password in that you write
your email and you simply send that, Hey, send me the instruction, how can I reset my password?
Now in the back end, you actually go ahead and check whether this user exists in your database or not.
If he exists, then we simply create a method which is a token generation.
Now, this token generation method actually go ahead and creates a token.
And now what is going to happen after that?
This is the most important thing.
This token generation is going to create a token, and this token will be sent to both database and
to you as well.
Now, what's going to be inside this token?
A simple string, obviously complex a string or long number of crypto hash and then expiry date as well.
Now, once you have this into the database as well as being sent to the user, the next request needs
to come from the user itself.
User will be sending this exact token from the URL or maybe from other places as well.
Doesn't really matter.
You might have seen this sometimes that an email comes up, you simply click on that.
When you click on that, you are actually transform into a long, long string up there.
Now after that, you simply go ahead and send me the new passwords or the password, whatever it is,
or maybe confirm password and all of that, and you send it to the back end.
Now in the back end, it is my responsibility to first check the expiry that the token that you are
bringing up in the URL, does the expiry has expired or is it still a valid token?
If the expiry is still valid, then I go ahead and compare the token itself that the token which is
stored in my database is actually exactly the token which you have sent me from the front end or from
your end as well.
Now, if the both of them matches, then I simply go ahead and allow you to change the password.
And that's how the forgot password works on.
Now, for a moment, I hope you have understood this one for a moment.
Thing that how you can actually use this exact same flow in verifying the user.
Can we have a brainstorming on that as well?
We won't be implementing it, but I am pretty sure having this brainstorming session will help you to
understand this one.
So let's just say a user has registered on their website.
He has created email, password and everything.
Now you want to verify him.
So what you're going to do, you're going to just simply add a field onto your database which says is
user verified or something similar and it's going to be default as false.
Now you also go ahead and request this token generation that, hey, create me a token generation,
and this will help me to actually turn this flag or a simple field is user verified to on and off.
Now this is not the job of this token generation to check that field.
This is the job in the back end controller itself.
The job of this token generation is to simply create a token.
Now, what we're going to do again, we're going to go ahead and send this token to both places, the
database and to the user as well.
The user clicks on the link and that's it.
We are going to just take that link onto the database.
We are going to first match whether the link has expired or not.
No, it has not expired.
Then we're going to verify the string that the string that I am holding in the database is actually
the same string that is being sent to the user itself.
If both the string matches, that means the user is verified and I can turn on the flag as on that.
Yes, this user is verified so that later in the future I don't have to create this token again.
Again, this is a brainstorming session and these sessions are really important to actually understand
what you are about to do.
So in the next video I will walk you through that how we can add a couple of more fields, including
this token generation and some more fields so that we can provide the functionality of the forgot password
to any user.
So I hope this diagram will help you.
Again, these are all presentations that everything will be available to you so that you can actually
revise it whenever you want to.
Let's go ahead and catch up in the next video.